Hong Kong Privacy Commissioner warns of agentic AI risks
Hong Kong's Privacy Commissioner issued a warning about security and privacy risks from agentic AI systems, particularly OpenClaw, before deployment. The office recommended limiting system permissions granted to such systems and avoiding sharing sensitive personal data with them.
What happened
The Hong Kong Office of the Privacy Commissioner for Personal Data issued a warning about security and privacy risks from agentic AI systems, particularly OpenClaw, advising organizations and members of the public to be cautious before deployment and use.
The office identified risks including potential data leakage, malicious system hijacking, and the possibility of misinterpreting user instructions leading to unintended deletion of important data.
Reported impact
The Privacy Commissioner noted that agentic AI poses higher privacy risks compared to standard AI chatbots due to the extended capabilities and permissions these systems require to operate.
Index analysis
The office recommended that agentic AI systems should be granted only the minimum permissions necessary to complete assigned tasks, and that users should avoid providing sensitive personal data such as identity documents, bank account numbers and passwords.
The Privacy Commissioner advised users to retain final control over data transmission and system configuration changes, and to verify that plugins use official latest versions free from malicious code.
Governance controls
The Privacy Commissioner recommended that organizations should only grant agentic AI systems the minimum permissions required to complete tasks and should avoid granting administrator account permissions.
The office advised users not to readily provide personal data to agentic AI systems and to maintain ultimate control over data transmission and system configuration modifications.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.