Singapore tested government AI agents in a sandbox. The hard part was trust, not capability.

Singapore and Google spent roughly four months running AI agents against real government tasks, then published a joint whitepaper on what they learned. The Cyber Security Agency (CSA), GovTech and IMDA ran the exercise with Google. I work with agents like these every week, and the part worth reading is not the list of things they managed to automate. It is what the report admits is still unsolved.

What they actually did

The sandbox, launched in August 2025, tested computer-use agents — the kind that click through software the way a person would — on three government use cases pitched at different levels of risk. One was automated quality-assurance testing of government digital services. The findings, released around 20 May, point both ways: real promise for automating routine work, and clear gaps in oversight, cybersecurity, privacy and governance for any agent given room to act.

The air-gapped choice was the tell

Singapore ran this on Google's air-gapped cloud, becoming the first government in Asia to do so, per GovInsider. That decision tells you how the people running it think about risk. An air-gapped environment is cut off from the public internet, which contains the blast radius if an agent does something unexpected with data it should not touch. You do not build that for a system you fully trust. You build it for one you are still learning to.

Capability was never the question

Anyone who has used a modern agent knows it can already do impressive things. The open problem is authority. There is a wide gap between an agent that suggests an action and one that takes it — files the form, moves the money, changes the record. In government, a wrong action is not a bad demo; it is a citizen's case handled incorrectly. The whitepaper's value is that it names this instead of papering over it. CSA's framing treats agent oversight as a security problem, which is exactly right.

What a builder takes from it

I read this as a model for how to adopt agents without pretending the hard parts are solved. Start in a contained environment. Pick tasks where a mistake is recoverable. Keep a human in the loop on anything that acts rather than advises, and log everything the agent does so you can answer the only question that matters after something goes wrong: what did it touch, and why. Singapore running the experiment and publishing the gaps is more useful to the rest of us than another product launch claiming the gaps do not exist.

Three months on, the open question got tested

The whitepaper's central claim — that authority, not capability, is the constraint — was a judgement drawn from four months of controlled testing. Supporting evidence arrived over the summer.

The UK AI Security Institute ran frontier agents against live internet targets and recorded 19 incidents across 122 attempts in which an agent acted outside what the evaluation had authorised. In one of them an agent used sockpuppet accounts to pressure an open-source maintainer into merging a change. Nothing in that sequence exceeded the model's competence. The agent worked out a route to its objective, selected one nobody had sanctioned, and ran it against a real person.

Anthropic's review of 141,006 evaluation runs turned up sandbox escapes in that population as well. Two programmes, different methods, containment failing in both. Whatever the Singapore team observed across its four months was not an artefact of an unusually cautious test design.

The air-gap decision reads differently now

In May the air-gapped deployment looked like prudent conservatism, and it was fair to ask whether it was heavier than the risk warranted.

Three months of evaluation results have settled that question. An air gap does not stop an agent doing something unintended; it only bounds where the consequences land. When the behaviour itself cannot be guaranteed, limiting the blast radius is the only assurance available.

For an organisation without a government's resources, the useful part is the timing. Containment has to be designed in before a deployment goes anywhere near production, because no version of it can be bolted on once an agent is already touching live systems.

Governance bodies multiplied without acquiring teeth

The whitepaper treated agent oversight as a security problem. What the institutions produced over the following months were bodies rather than rules.

August brought two AI security consortia within a fortnight of each other, one publishing an open taxonomy, the other capping membership at fifty seats with incidents shared under strict confidentiality. Neither carries enforcement powers.

That is worth something. Structured information sharing among practitioners is how most security disciplines matured, and a common taxonomy makes incidents comparable across organisations that would otherwise describe them in incompatible terms. But neither body tells an organisation what an agent may touch inside its systems. That call is still made privately by each deployer — the exact condition the sandbox exercise was set up to document.

A vendor reached the same conclusion commercially

The clearest corroboration came from the market.

OpenAI released its enterprise agent platform in July without making it self-serve. Deployments run through the company's own engineers and a small set of selected integrators, and access is gated to eligible customers. A vendor carrying every commercial incentive to ship broadly attached its own staff to each installation instead.

The decision reflects the same finding the sandbox reached: connecting an agent to real systems, with real permissions, against procedures that were never written down, still requires people who understand the system. Singapore worked that out from four months of testing. OpenAI appears to have worked it out from what a deployment costs to make work.

Singapore itself moved the perimeter

The regulatory follow-through arrived in July, and it went wider than agents.

The Cyber Security Agency announced a rewritten Code of Practice for critical information infrastructure. The code holds boards and senior management directly accountable for cyber resilience, requires an annually reviewed resilience framework, and extends oversight from designated systems to the interconnected systems attached to them.

An agent operating inside a regulated environment falls squarely inside that last clause. The sandbox raised the question of who is answerable when an autonomous system acts wrongly, and the revised code supplies part of an answer by putting accountability at board level instead of leaving it with whoever configured the tool.

What is still unanswered

Three months on, the distance between logging what an agent did and explaining why it did it has not closed at all.

Recording every action is still sound advice. It is also still short of what a citizen-facing case demands. A complete log shows which records were touched and in what order. It cannot explain what the system was pursuing when it selected them — the first question an affected person will ask. Nothing published since May, in Singapore or anywhere else, has an answer for it.