How to Set Limits on Your AI Assistant Before It Acts for You (2026)

Singapore’s cyber authorities issued a blunt warning on 6 November 2026: personal AI agents are not chatbots, and you should not hand them the keys to your digital life. The joint advisory from the Cyber Security Agency (CSA), GovTech and the Infocomm Media Development Authority (IMDA) says agents that act on your behalf can be tricked into moving money, sharing private data or doing things you never asked for. This guide turns the advisory into five limits you can set in about five minutes — before your agent acts for you.

Quick answer: Singapore's CSA, GovTech and IMDA warned on 6 Nov 2026: personal AI agents can be tricked into moving money or sharing data. Set these five limits first.

What Singapore actually warned about

Personal AI agents do things, not just answer questions. Unlike a conventional chatbot, a personal AI agent can manage your email, make bookings, browse websites and reach into your online accounts — and some keep working in the background while you are not looking. The advisory names five examples: Dots, Hermes, Muse, Grok Bot and OpenClaw.

The risk is not that the agent is malicious — it is that the agent is obedient. “Depending on the access you give them, AI agents may read and reveal sensitive personal information, make mistakes, or take actions that you did not intend,” the authorities said. Scammers can plant hidden instructions in websites, emails, calendar invitations, messages, documents or images, and an agent that reads them may follow them as if they were your orders.

“AI agents can be very useful, but you cannot treat them like human assistants and give them the same broad access to your information and implicit trust.” — CSA, GovTech and IMDA joint advisory, 6 November 2026

You stay responsible. The advisory is explicit that users remain responsible for how they use AI agents, including actions taken on their behalf, and may be held liable depending on the circumstances and the law. That is the whole point of setting limits first: the agent’s mistake becomes your problem.

The five limits to set now

1. Connect only the apps the task actually needs. If your agent is booking a restaurant, it does not need your email, your files and your contacts. Connect the minimum, and restrict what it can see inside each service where the app allows it. Every connection is a door you have opened — count them.

2. Never connect banking, government or healthcare accounts. This is the advisory’s hardest line, and it is worth treating as a rule, not a suggestion. No agent needs your bank, your government services or your health records to be useful, and those are exactly the accounts where a mistake or a trick costs real money or exposes the most sensitive data you hold. The same goes for credit card details: do not hand them to an agent.

3. Start read-only, and make the agent ask before anything consequential. Begin with limited or read-only permissions wherever the app offers them. Then require approval before the agent sends a message, deletes or shares a file, posts public content or makes a purchase — and prefer one-time approvals over standing permission to repeat similar actions without asking again. Check the details yourself before approving anything high-risk.

4. Set permissions in the app’s settings, not in chat. Telling an agent in conversation to “only read, never send” is not a control. The advisory warns that instructions given through chat may not always be followed consistently. Use the permission switches in the app’s settings — that is the enforcement layer. If an agent offers no real permission controls, treat that as a reason to limit what you connect to it.

5. Review what it remembers, and revoke what you no longer need. Many personal agents keep persistent memory and build profiles of you — and of your contacts — from past chats and connected files. The advisory tells users to review that stored information regularly and delete anything inaccurate or anything they do not want stored or used. Pair that with a regular permission review: revoke access you no longer need, and check the agent’s activity history to confirm it is doing what you expect. For a hands-on way to test what an agent actually remembers, see our guide on how to test Muse Active Memory and Focus in 2026: https://openaimaster.ai/how-to-test-muse-active-memory-focus-2026/

The never-share list

Some things should never reach an agent at all. Do not disclose usernames, passwords, passcodes, one-time passwords (OTPs) or other authentication credentials to an AI agent. For Singpass-linked services, the advisory says to choose passkey authentication by default, complete the authentication yourself, and never approve an unexpected request. For other services, choose authentication methods that require a human action — a tap or a biometric check you perform — rather than something the agent can complete on its own.

How scammers trick your agent

The attack does not target you — it targets your agent. A hidden instruction can sit inside a web page your agent browses, an email it reads, a calendar invitation it processes, a document it summarises or an image it looks at. The agent, trying to be helpful, may follow it: making a purchase, transferring money or revealing private information. Because some agents run in the background, you may not notice anything has gone wrong until later.

Three habits close most of that gap. Watch your agent while it browses, and stop it if it tries to open a site you did not intend or take an action you did not authorise. Make sure it is not logged in to important accounts while it works. And download agents only from official sources, avoiding untrusted third-party add-ons that could carry their own hidden behaviour.

Our take: the five-minute permission audit

This is the part the advisory implies but does not spell out — a single pass you can do tonight. Open each agent you use and sort every connection into one of three tiers:

TierWhat it meansExamples
Read-onlyThe agent can look, never actCalendar view, email search, file search
Ask me firstThe agent proposes, you approveSending messages, bookings, purchases, sharing files
NeverNo connection, no credentialsBanking, government services, healthcare, passwords and OTPs

The rule that ties it together: if money, messages or someone else’s data are involved, the agent asks first. That single rule covers most of the advisory’s advice in one sentence, and it is easy to test — if your agent can send money or a message without asking you, its limits are wrong. Run the audit again whenever you connect a new app, because every new connection resets the risk.

What to do if your agent is compromised

Act fast, in this order. Stop the agent’s activities immediately and disconnect the affected accounts. Review its activity history for anything suspicious — unauthorised payments, changed account settings, unfamiliar devices or new payees. Change your passwords, revoke permissions you no longer need, and tell anyone who may have been affected. If money is at risk, activate your banking app’s kill switch or lock your cards and call your bank on its official hotline. In Singapore, the 24-hour ScamShield Helpline is 1799, and anyone who has lost money or suspects a crime should make a police report.

One more consideration the advisory raises: other people. Your agent may hold personal information belonging to your contacts, so avoid sharing other people’s sensitive information unnecessarily — and say so when a message was sent by an AI agent rather than by you. (Muse is one of the agents named in the advisory; if you use it, our guide to Muse Voice explains how its voice mode works: https://openaimaster.ai/how-to-use-muse-voice-2026/ — and for the wider agent-permissions picture, see our explainer on Anthropic’s open-sourced agent skills: https://openaimaster.ai/anthropic-agent-skills-open-source/)

FAQ

Which AI agents does Singapore’s advisory name?

Dots, Hermes, Muse, Grok Bot and OpenClaw. The advice applies to personal AI agents generally, not only to those five — they are examples of agents that act on a user’s behalf rather than just answering questions.

Can an AI agent really move money without me knowing?

Yes, if you gave it the access. An agent with payment or banking access, or one tricked by hidden instructions in a page or email it reads, can make purchases or transfer money. Some agents keep working in the background, so you may not notice straight away — which is why the advisory says to require approval for consequential actions and to monitor activity.

Should I ever give an AI agent my password or OTP?

No. The advisory says never to disclose usernames, passwords, passcodes, one-time passwords or other authentication credentials to an AI agent. For Singpass services, use passkey authentication by default and complete the authentication yourself.

Is it enough to tell my agent in chat not to do something?

No. The advisory warns that instructions given through chat may not always be followed consistently. Set permissions through the app’s settings instead — that is where the control is actually enforced.

What is Singapore’s ARC Framework?

GovTech presented the Agentic Risk and Capability (ARC) Framework at its STACK Conference on 5 November 2026, a day before the consumer advisory. It maps what agents can do against the safeguards that should sit next to each capability. The consumer advisory is the practical, household-facing half of the same push — the framework is for builders, the advisory is for users.

Sources and methodology

Method: the advisory’s advice was verified against the CNA report read in full on 8 November 2026, with the advisory PDF and the ARC Framework coverage as supporting sources. Every claim in this article rests on the advisory itself; the permission tiers and the five-minute audit are this site’s own organisation of that advice, not the authorities’ words. This article was desk-researched, not hands-on tested. Verification date: 8 November 2026.

Leave a Reply

Your email address will not be published. Required fields are marked *