SINGAPORE: The Cyber Security Agency (CSA), GovTech and the Infocomm Media Development Authority (IMDA) issued a joint advisory on Friday, Nov 6, warning that personal AI agents can be manipulated into moving money or leaking private data. The advisory names OpenClaw, Dots, Hermes, Muse and Grok Bot as examples of the tools it is worried about, and tells consumers to stop handing them the same access they would give a human assistant.
What the advisory actually says
The agencies draw a hard line between chatbots and agents. A chatbot answers questions. An agent acts. It reads email, opens calendars, pulls contacts and files, browses websites, makes bookings and touches online accounts on the user's behalf.
That is the point of the category, and also the problem. Depending on the access granted, an agent can read and reveal sensitive personal information, including data belonging to other people, make mistakes, or take actions the user never intended. Some keep working in the background after the user has walked away.
The agencies also flagged outside manipulation. Malicious actors, websites or messages can be crafted to steer an agent into harmful actions, a risk that grows as agents are given more autonomy and more credentials.
"AI agents can be very useful, but you cannot treat them like human assistants and give them the same broad access to your information and implicit trust," the advisory states.
The rules the agencies set
Most of the guidance is about permission hygiene rather than banning the tools outright. The core instructions:
- Connect only the apps and accounts an agent genuinely needs for a specific task, and restrict access further inside each service where possible.
- Never connect banking, government or healthcare accounts, and never hand over credit card details, passwords, passcodes or one-time passwords.
- Start with limited or read-only permissions, and require separate approval before sending messages, deleting or sharing files, publishing content or making purchases.
- Prefer one-time approvals over standing permission, and check transaction details before approving anything high-risk.
- Change permissions in the app's settings, not by typing instructions into a chat, because agents do not always follow those instructions consistently.
Singpass users get an extra rule: use passkey authentication by default, complete the authentication step personally, and do not approve unexpected prompts.
Users are also told to review granted access regularly, revoke what is no longer needed and watch what their agents are doing, and to check what an agent provider does with the data it collects from connected accounts.
Why it matters
The liability clause is the part worth rereading. The agencies state that users remain responsible for how they use AI agents, including actions taken on their behalf, and may be held liable under applicable law. A rogue booking or a resent inbox is not automatically the vendor's problem.
The timing is not accidental. OpenClaw has spent the year spreading from hobbyist Mac Minis into offices, with self-hosted installs, third-party skill extensions and gateway tokens that security teams cannot easily audit. Advisory bodies rarely name consumer products unless the install base has already outgrown informal warnings.
For anyone already running one of these agents, the practical change is small but immediate: open the permission screen, cut everything that is not needed for the current task, and stop treating a chat instruction as a security control.
Comments