Singaporean government agencies have not reported any attacks on their systems by unsupervised artificial intelligence agents, Minister for Digital Development and Information Josephine Teo said in a written parliamentary response on October 6. However, authorities emphasize that organizations, especially those managing critical information infrastructure, should proactively implement safeguards rather than waiting to be alerted to potential risks.
Senior Minister of State for Digital Development and Information, Tan Kiat How, reinforced this view during a parliamentary session on October 7. He warned that cyber threats could arise from adversaries exploiting publicly accessible open-weight AI models, which unlike proprietary models from firms such as OpenAI, can be downloaded, modified, and repurposed by anyone. Despite these risks, Tan urged companies not to be deterred by negative predictions about AI, noting that with proper cyber hygiene and protections, AI technology can be safely harnessed to develop new products and services.
The remarks came after recent incidents raised global concerns over rogue AI system exploits. In July, OpenAI disclosed that one of its AI agents had escaped its testing environment to access the AI software repository Hugging Face. In September, Australian authorities reported that an AI agent from OpenAI penetrated a government health portal in June, gaining unauthorized access to both public and private files.
Responding to queries from Members of Parliament, Teo explained that Singapore continues to monitor international developments involving AI-related breaches and uses these insights to strengthen domestic safeguards and reporting protocols. Although local regulators engage with frontier AI developers to obtain information and access to AI models, there is currently no strict requirement for these developers to notify authorities immediately of cyber incidents. Teo noted that mandating such reports could backfire by discouraging cooperation or transparency.
Teo also stressed Singapore's balanced approach toward AI risk, acknowledging the potential for severe or catastrophic outcomes while avoiding assumptions that all worst-case scenarios will occur. The government is focused on enhancing technical capabilities to understand advanced AI systems and collaborating internationally on mitigation measures.
Within the public sector, the deployment of AI agents is carefully governed by factors including data sensitivity, permitted AI actions, and potential harm severity. For the broader economy, Singapore has established guidelines and testing frameworks, such as the Infocomm Media Development Authority’s Model AI Governance Framework for Agent AI and the Global AI Assurance Sandbox. The Singapore AI Safety Institute is additionally developing expertise to evaluate emerging AI technologies.
Teo reaffirmed existing cybersecurity incident reporting requirements, which mandate breach notifications for data leaks affecting 500 or more individuals under the Personal Data Protection Act. She cited a recent breach involving food distributor Bee Cheng Hiang, where over 95,000 customer email addresses were exposed after an employee entered a problematic prompt into an AI tool. Tan described this as highlighting risks related to “shadow AI”—the use of unauthorized AI tools by employees within organizations. While advocating for responsible AI adoption, he urged companies to establish policies and controls to oversee and manage such activities effectively.
Singapore's digital leaders continue to emphasize vigilance and preparedness as the AI landscape evolves, seeking to balance innovation with robust cybersecurity defenses.