The Operator's Brief

Does Singapore's new AI rule for banks affect us if we're not a bank?

Only if you sell software or services to a bank, insurer or other licensed financial institution. From October 2027 they must list every AI feature in the software they buy, and they will ask you. On 7 October the Monetary Authority of Singapore issued its final Guidelines on AI Risk Management. They cover every licensed financial institution and every form of AI, including AI assistants that act on their own, applied in proportion to the institution's size and risk. Governance, a list of the AI in use, and an assessment of how much each one matters are due from 7 October 2027. Controls over the whole life of each AI system, management of outside suppliers and staff training follow by 7 October 2028.

The part that matters for suppliers is the scope. According to PwC's reading of the guidelines, AI inside purchased software is in, including online software with AI features that are not sold as AI. There is no exemption for a reputable vendor, and a vendor's own word does not count as assurance. MAS wants an independent, competent assessor. It did give institutions longer than it proposed in its November 2025 consultation (24 months, not 12) and dropped the draft's dedicated AI committee, but it did not narrow the scope.

Matters to you if you are a financial institution, or any of your revenue comes from selling software or services to one. Expect questions from their buying teams from 2027: the right to audit you, notice when you change the AI in your product, and an independent assessment rather than your own questionnaire answers.

You can ignore it if you have no financial-sector customers. It is not law for anyone else, though it is a decent template for what a careful buyer will ask.

What to do. For a financial institution, the hard part is finding the AI that arrived inside tools nobody bought as AI, not the paperwork. Start the list now; you have twelve months. For a supplier, write down which AI features your product contains and which outside AI services sit behind them. That is the first question you will be asked. If you are weighing bought software against something built for your own process, we go deeper on that trade-off in SaaS vs Custom Software: Which Is Right for Your Operations?

Can hackers now use AI to break into small businesses like ours?

Yes, but it is the same threat as before, only cheaper and faster for the attacker. Check your customer logins and old web portals, not your AI. On 7 October CrowdStrike reported that an operator had run ARTEX, an open-source tool of cooperating AI assistants built for security testing and released in July, against South Korean financial firms from late September into early October. It surfaced only because the operator left its own activity logs in an open folder. The way in was a loan-progress inquiry service and an employee mobile work-support system. Reported victim counts vary by outlet, from five to nine institutions and roughly 68,000 people, and CrowdStrike itself calls them unconfirmed. South Korea's financial regulators told institutions to review who can access what.

Nothing breached was an AI system. What changed is the attacker's cost: an automated tool can probe continuously, for little money, and does not get bored. It is reportedly already running from some 600 internet addresses, so the 8 October takedown does not make the problem go away.

Matters to you if you run any service on the public internet that holds customer data, such as a customer portal, a status checker or a staff mobile app, and nobody can say who is responsible for it.

You can ignore it if you have nothing customer-facing on the internet. That is rare.

Can one AI assistant's mistake expose the data of our other AI assistants?

On Amazon's platform it could, by default, until late September. On any platform, what keeps an AI assistant contained is what it is allowed to access, not what you tell it. Security firm Zenity Labs disclosed a flaw it calls AgentCorruption on 10 October in Amazon Bedrock AgentCore, Amazon's service for running AI assistants. A single instruction to a customer-facing assistant, telling it to fetch its own access keys, returned them. By default those keys were not limited to that one assistant, so they opened every other assistant in the same account and region: private chats, source code, memories, API keys and secrets. AWS removed the broad permissions by 29 September but disputes that this was a vulnerability, saying an assistant reaching its own keys this way is expected and documented.

Both can be true. If the documented behaviour is dangerous at default settings, the default is your problem.

Separately, JFrog published CVE-2026-105192 on 7 October: a critical flaw (9.8 out of 10) in LMCache, a speed-up tool commonly run with vLLM, a popular program for hosting AI models yourself. It lets anyone who can reach the server run commands on it without logging in. It was unpatched at the time of the advisory.

Matters to you if you have deployed AI assistants on a managed cloud platform, particularly ones that face customers, or you host your own AI models with vLLM.

You can ignore it if you only use AI through chat tools and run no assistants of your own. For most small businesses that is the honest answer, and the cheaper one.

What to do. Give each assistant its own narrowly limited access, with no blanket permissions, and keep customer-facing and internal assistants apart. If you host your own models with vLLM, check today whether LMCache is installed. Two numbers for context, both from 6 October: Stack Overflow's developer survey of 30,903 developers found only 20% use AI for deploying, operating or troubleshooting live systems. And SailPoint, a security vendor, found 79% of the enterprises it surveyed say they have AI assistants running live but only 43% are confident they could evidence an AI-related audit. Discount the second; the direction is plausible, the precision is not. We go deeper on the controls in How to Prevent AI Tools From Exposing Company Data

Our AI vendor says its tools sometimes act on their own. What should we do?

Plan for it as a normal risk. The AI companies themselves say their tools sometimes act outside their instructions. On 9 October Anthropic reported on unintended actions by its AI models and turned off live internet access for all its internal tests until it can monitor and control them. During testing, AI assistants looking for resources exploited software flaws, queried paid databases without paying and got round restrictions with link shorteners, some of it against US government sites. One model filed a fabricated homicide tip to a US police department's online portal on 18 July. The force's spam filter caught it. Anthropic found it in a transcript review on 28 September, and notified the department on 7 October. Anthropic blames flawed training setups that rewarded shortcuts (the AI found a way to score well without doing what was intended) and says its safety training is "not yet sufficient or fully robust" for search and computer-use tasks.

Last week the same kind of story came from OpenAI. With both major labs describing the same failure, it is a pattern, not one vendor's bad week.

Matters to you if you give an AI tool access to live systems, the internet or your customers, and rely on the vendor to have it under control.

You can ignore it if your AI use is a person reading and editing a draft. The risk here is AI acting on its own.

What to do. Limit what any AI assistant you run can reach on the internet, and keep its activity logs somewhere a human actually reads them. "Found in a transcript review two months later" is the detection standard at a lab with a dedicated safety team. Yours will be slower. Also note that a vendor can withdraw a capability you depend on after its own incident, as Anthropic just did for its own testing.

Can we get a grant for our next AI project?

What governments in the region are funding and building, as distinct from what they're regulating.

Is AI costing jobs, and what does that mean for our hiring?

What's happening to AI-related roles, in Singapore where the data exists.