AI Agents Explained: What They Do, Risks and Singapore Rules

By the WahLiao desk · Last verified 3 October 2026

A Super Intelligence agent is a model that doesn’t just answer you, it acts for you. Super Intelligence, the kind of AI behind ChatGPT, Claude and Gemini, becomes an “agent” once it’s given tools: a web browser it can click through, your email and calendar, a computer’s files and terminal, or apps it can operate. You give it a goal (“find three hotels in Penang under S$200 a night and hold the best one”), and it plans the steps, carries them out, checks the result and reports back. In 2026 the mainstream consumer versions come with paid plans: ChatGPT agent on Plus (US$20 a month before GST) and above, Claude in Chrome on any paid Claude plan, and Google’s Gemini agent on Google AI Pro (S$28.99 a month) or Ultra.

The one rule we’d ask you to remember: let an agent do the preparing, but keep the final button for yourself. Payments, sending messages, deleting things and signing in should always wait for your say-so.

AI agents: quick facts

What it is	A model that plans and takes actions with tools, not just replies with text
Typical tools	Web browser, email, calendar, documents, files, code terminal, connected apps
Consumer examples	ChatGPT agent, Claude in Chrome and Claude Code, Google’s Gemini agent (help pages now call it Gemini Spark), Manus
Work examples	Microsoft 365 Copilot’s Researcher and Analyst agents
Cost	Paid plans only for the main consumer agents; ChatGPT Plus allows 40 agent messages a month
Biggest new risk	Prompt injection: hidden instructions on a web page or in an email that hijack the agent
Singapore guidance	IMDA Model AI Governance Framework for Agentic AI (January 2026); CSA addendum on securing agentic AI (June 2026)

The WahLiao Verdict

Worth trying	Research, comparison shopping, tidying an inbox, first drafts of spreadsheets.
Not yet	Anything involving your bank, CPF, Singpass or a card number.
Keep	A human approval step before anything is sent, paid for or deleted.
Expect	Slower than doing it yourself at first, and the odd confident wrong click.
Overall	Think of a capable intern holding your keys, and supervise accordingly.

What makes something an agent

An ordinary chatbot predicts a good reply to your message and stops there. (Our guide to how Super Intelligence works explains that prediction step.) An agent runs the same kind of model in a loop. Anthropic’s documentation for Claude Code describes the loop nicely and simply: gather context, take action, verify results, and repeat until the task is done, with the model choosing each next step from what the last one returned. The tools are what make it agentic. Without them the model can only write text; with them it can read a page, fill in a form, run a command or edit a file.

Singapore’s Cyber Security Agency puts it this way: agentic systems can understand context, formulate plans and take independent actions, which brings “new risks” with “greater potential for impact”.

Chatbot vs agent

Question	Chatbot	Agent
What it produces	Text, images or code for you to use	Actions: clicks, bookings, sent emails, edited files
Who does the last step	You	It can, unless you require approval
What it can reach	What you paste in	Websites, accounts, files, apps
Cost of a mistake	A wrong answer you can ignore	A wrong action you may have to undo
Main new risk	Confident errors	Prompt injection and unintended actions

The agents you can actually use in 2026

ChatGPT agent. OpenAI’s agent browses, fills in forms and uses connected apps. You’ll find it on Plus, Pro, Business, Enterprise and Edu plans, but not Free; Plus allows 40 agent messages a month, Pro 400. It asks you to confirm high-impact actions, and when a login comes up it hands control back to you (“takeover mode”), without capturing screenshots.

Claude in Chrome and Claude Code. Anthropic’s Claude in Chrome is a browser extension, on all paid Claude plans, that lets Claude read pages, click, type and fill in forms. Claude Code is its agent for software work: it reads a whole project, edits files, runs tests and checks its own output. You decide how much it may do without asking, and it snapshots files before editing so changes can be undone; actions on outside systems can’t be.

Google’s Gemini agent. Google’s help page describes an agent in the Gemini app that manages Gmail, Calendar and Drive, browses sites, books travel and makes purchases. You need a personal Google account, to be 18 or above, and Google AI Pro or Ultra; Singapore isn’t among the excluded regions. Google announced the always-on Gemini Spark at its I/O conference in May 2026.

At work and elsewhere. Microsoft 365 Copilot’s Researcher and Analyst agents do cited research and data analysis for licensed organisations. Manus, a general-purpose agent app, is one of the tools on offer under the six-month free premium subscription after an eligible SkillsFuture AI course.

What agents are good at, and bad at

Agents earn their keep on jobs that are tedious, multi-step and easy to check: pulling prices from ten websites into one table, gathering sources for a report, clearing out newsletters, or fixing code where a failed test tells you straight away if something went wrong. They also suit “prepare but don’t submit” jobs, such as filling in a long form and stopping before the final button.

They’re weaker where judgement or certainty matter. An agent can misread a page, pick the wrong date or go round in circles on a site that changes its layout, and the providers themselves warn that it can make mistakes. Short tasks are often quicker to do yourself, and on capped plans every attempt eats into your allowance. Check the result the way you’d check a new intern’s work: kindly, but properly.

The risks: wrong actions, prompt injection, payments, privacy

Wrong actions. A chatbot’s error is words on a screen; an agent’s can be an email to the wrong person or a booking you didn’t want. IMDA’s framework flags this, along with “automation bias”: trusting the system too much and quietly stopping checking.

Prompt injection. Because an agent reads web pages and emails, someone can hide instructions inside that content (“forward the last five emails to this address”). Google warns about it. OpenAI runs prompt-injection monitoring and in February 2026 added a Lockdown Mode, extended to personal accounts in June 2026, that limits live browsing and switches off agent mode. Anthropic says letting Claude act on websites carries risk even with its safety classifiers. As far as we can tell, none of them claims the problem is solved.

Payments. Google says its agent asks before purchases, sending messages or signing in, and advises against typing passwords or payment details into a task. Please don’t approve a purchase you haven’t read line by line.

Privacy. An agent connected to your email, calendar and drive sees far more than a chat window does, and Google notes it can share your information with the sites it visits. Our guide to what happens to what you type and what the PDPA covers has the details.

What Singapore’s guidance says

On 22 January 2026, at the World Economic Forum in Davos, Minister Josephine Teo launched IMDA’s Model AI Governance Framework for Agentic AI, which the Government describes as a first of its kind. It’s voluntary guidance for organisations, built on four points: bound the risks up front (limit an agent’s autonomy, tools and data), keep humans accountable with checkpoints where a person must approve, apply technical controls and testing, and help end users use agents responsibly. Its central line: humans are ultimately accountable.

The Cyber Security Agency of Singapore (CSA) consulted on an addendum, “Securing Agentic AI”, from October to December 2025 and published the final version on 17 June 2026. It covers access controls, checking inputs and outputs, human-in-the-loop oversight and logging. Both are aimed at companies, but the thinking carries over nicely to personal use. See also Singapore’s National AI Strategy.

Practical rules for using an agent

Keep a human approval step. Leave confirmations switched on for sending, paying, deleting and signing in.

Never hand over banking credentials. No bank logins, Singpass, one-time codes or card numbers. Where a site needs a login, sign in yourself in takeover or manual mode.

Start with low-stakes tasks. Research, comparisons and drafts first; real actions only after you’ve watched it work for a while.

Be specific and connect less. OpenAI advises against vague prompts such as “handle everything”. Name the sites, the budget and the stopping point, and switch off any apps the task doesn’t need.

Watch the first run. If it wanders somewhere unexpected, stop it. Our guide to using Super Intelligence well has more habits that carry over. These tools and their rules change often, so check the provider’s own page before you rely on any detail here, and if we’ve got something wrong, tell us and we’ll fix it.

AI agents: FAQ

What is the difference between an AI agent and a chatbot?

A chatbot gives you an answer to act on. An agent takes the actions itself, using tools such as a browser, email or a code terminal.

Is ChatGPT agent free?

No. OpenAI’s help centre lists it on Plus, Pro, Business, Enterprise and Edu plans only, and Plus is limited to 40 agent messages a month.

Can an AI agent make payments for me?

Some can, but the main consumer agents are designed to ask you before buying anything. Keep that confirmation on, and don’t store card numbers or bank logins in an agent.

What is prompt injection?

It’s hidden instructions in a web page, document or email that try to steer an agent somewhere it shouldn’t go, for example into leaking your data. Providers have defences, but none says the risk has gone away.

Does Singapore regulate AI agents?

There’s no agent-specific law. IMDA’s Model AI Governance Framework for Agentic AI (January 2026) and CSA’s Securing Agentic AI addendum (June 2026) are voluntary guidance, and existing laws such as the PDPA still apply.