Singapore is turning to major technology firms to strengthen its cyber defences, even as it presses them for greater transparency over security breaches – a balancing act facing regional governments as they seek to harness artificial intelligence while guarding against the risks it introduces.

Those risks were highlighted by an AI agent linked to OpenAI that gained unauthorised access to files on an Australian government website earlier this year, raising questions over how quickly companies disclose security incidents as AI systems become more capable and autonomous.

At a summit earlier this month, Singapore launched a refreshed cybersecurity strategy that would see it progressively deploy AI across its cyber defence operations and work with industry partners to accelerate adoption, as it seeks to bolster protection for its critical infrastructure.

The city state would take a “pragmatic” approach to AI adoption, allowing it to choose between the “best available” models, K. Shanmugam, coordinating minister for national security, said during a speech at Singapore International Cyber Week on October 13.

“We will not need to develop our own AI models for every use case. What we really need is the capability to evaluate the best available models and to adapt them to our own needs.”Anthropic’s Claude is among the models Singapore is exploring as it seeks to strengthen its cyber defences. The US technology firm signed an agreement with Singapore on the sidelines of the summit, setting out areas of AI cooperation, including safety, security, responsible adoption and research into the impact of adoption.

“Singapore has been a leader in responsible AI, with a long track record of investment in model testing and evaluation,” said Anthropic co-founder Benjamin Mann at theg on October 13, a day before the firm opened its fifth Asia-Pacific office in the city state. Anthropic already has offices in Japan, India, South Korea and Australia.

“With this [memorandum of understanding], we’ll partner with Singapore to help ensure the transition to powerful AI goes well here, across Asia-Pacific, and around the world,” Mann said.

Safety and transparency concerns The partnerships offer governments access to emerging technologies and technical expertise, but also make transparency and oversight increasingly important as AI systems become more capable and autonomous.

On the sidelines of the event, Shanmugam told the media that Singapore had sought greater transparency from major technology companies, following meetings with firms including Anthropic, Google, Amazon and OpenAI.

“They need to notify us early on when something happens, taking a leaf from the experience in Australia and what happened there,” he said. “Generally, the companies have expressed an attitude of cooperation. But I would say it’s work in progress. It’s something that we are talking to them about.”Australian Prime Minister Anthony Albanese criticised OpenAI in September over what he called an “unacceptable” breach involving an AI agent that infiltrated a government health website and accessed public and non-public files in June. Albanese accused the firm of taking “way too long” to tell Canberra about the incident.

The San Francisco-headquartered company, which said it learned of the breach in August, apologised and acknowledged that its handling of the incident was “not enough”.

In July, open-source AI platform Hugging Face said it had been hacked by autonomous AI agents. Less than a week later, OpenAI revealed that the “unprecedented cyber incident” was driven by a combination of its models after it lost control of them during a security test.

Singapore had yet to encounter another attack like those attributed to cyberthreat group UNC3886, Shanmugam said. Last year, he revealed that the group had been targeting the city state’s critical infrastructure.

“We haven’t come across another attack like what we have heard from other countries,” he said. “But, you know, also, we don’t know what we don’t know.”Gatra Priyandita, a senior analyst at the Australian Strategic Policy Institute, said closer cooperation with technology companies did not necessarily increase the risk of such breaches and could help mitigate threats through information-sharing and technical evaluation.

He warned, however, that expanding AI use in governance could create new vulnerabilities that existing cybersecurity arrangements might not address.

“AI agents could inadvertently access unauthorised systems, expose sensitive information or be manipulated through malicious inputs,” he said, urging the establishment of clear boundaries on AI autonomy and the use of controlled environments during deployment.

The partnerships could also make it harder to determine who was responsible when disruptions or breaches occurred, Gatra said.

“If an AI system makes a mistake that disrupts government services, who is accountable? The government agency deploying it, the company developing it, or the officials who authorised its use?”

Asean cooperation Other Southeast Asian nations have also begun drawing on resources from major technology companies to strengthen their cyber defences, but industry experts warn that a widening digital divide could leave smaller states behind.

The Philippines and Google announced the expansion of a multi-year partnership in June aimed at strengthening Manila’s cybersecurity and subsea cable systems to ensure resilient digital connectivity. The country’s cyber-monitoring hub has also deployed Google Cloud’s security framework, which provides AI-driven cyber defence.

Last year, Thailand announced plans to adopt the Google framework, with the aim of enabling its cyberdefence centre to coordinate responses more effectively to online threats targeting government bodies and infrastructure.

But less developed states might lack the technical resources or negotiating leverage to secure timely disclosures from major technology firms through bilateral arrangements, said Gatra, who urged greater cooperation among members of the Association of Southeast Asian Nations.

“Singapore could work with Asean partners to develop common expectations around incident notification and cross-border information-sharing,” he said.

The city state has said it wants to strengthen the bloc’s collective cyber resilience by deepening practical cooperation and capacity building when it assumes the Asean chairmanship next year.

Shanmugam told the media that Asean already had a framework for dealing with cyberthreats but acknowledged that it remained a “work in progress”. The Asean cybersecurity cooperation strategy outlines five pillars, including strengthening readiness, advancing regional policy coordination and building capacity.

“We are all catching up on this issue of AI, and each country is focused on its own issues,” he said. “Asean collectively has some work to do in trying to deal with it together too. So, these are discussions that have to carry on.”