Singapore AI Governance: Firms Lag, Agentic AI Risks Emerge

Singapore's push for AI governance is moving faster than the organizations it aims to protect. New research from KPMG and the Institute of Internal Auditors Singapore warns that most companies are too slow in adapting to the AI technology they're already using. What's interesting is a four-month experiment, run jointly by government agencies and Google, tested autonomous AI systems. It found AI agents offered efficiency gains and stronger analytical capability, but also revealed significant risks. The most serious threat identified was indirect prompt injection. This is when a malicious actor hides instructions in content, tricking an AI agent into unintended actions. For example, in a social assistance scenario, an AI agent sometimes went to harmful external websites after misinterpreting text as instructions. The experiment concluded that no single control is enough; multiple layers of defense are needed. The research also highlighted a disconnect: digital disruption and AI are seen as a high risk by 73% of Singaporean organizations, but only 49% have internal audit coverage for it. The bottom line is that traditional governance frameworks aren't built for the complexities of agentic AI, which means organizations need to significantly update their risk management strategies.