Opening Address by SMS Tan Kiat How at the Singapore International Cyber Week Securing Smart Cities Event on 13 October 2026

Distinguished Guests, Colleagues,

1. Good afternoon. Very happy to join all of you here at the session this afternoon, “Securing Smart Cities 2026”.

2.  This year’s theme, “Securing Agentic AI in Robotics”, comes at an important moment.

3. We are entering a new phase of AI. AI is moving beyond the screen. It is increasingly able to perceive, make decisions, take actions, and interact with the physical world.

4. And Singapore is preparing for this future.

5.  Just two weeks ago, the Home Team opened the Home Team Humanoid Robotics Centre, with the aim of having humanoid robots work alongside Home Team officers in real operational settings by 2028. Potential applications include post-blast investigations, prison cell searches and handling hazardous materials.

6. These are exciting developments.

7. But they also raise an important question: Are our safeguards keeping pace with our machines?

8. Because when AI moves from the digital world into the physical world, the consequences of failure can change.

9. A cyber incident is no longer just about data or systems. It can affect what a machine sees, what it decides, how it moves, and ultimately what happens in the real world.

10. And that is why we should act now.

We have already seen the warning signs

11. We do not have to wait for the future to see the early warning signs.

12. In the digital world, increasingly capable AI agents are already testing the limits of our safeguards.

13. In July, OpenAI disclosed that during an internal cybersecurity evaluation, its models circumvented controls intended to isolate them from the internet, exploited vulnerabilities in shared infrastructure, and eventually reached Hugging Face’s systems. The investigation also found that agents had discovered ways to communicate and share techniques with one another outside their intended boundaries.

14. More recently, an AI agent gained unauthorised access to parts of an Australian government healthcare portal while carrying out a research task. The Australian Government has said that no personal Medicare information appeared to have been accessed, but it has launched an investigation into the incident.

15. These incidents are different. They occurred in different circumstances, and we should be careful not to overstate what they tell us about the technology.

16. But they point to a common lesson: AI systems can sometimes take actions that their developers did not anticipate.

17. When these systems operate in the digital world, the consequences may be contained. When they are connected to vehicles, robots, industrial systems or public infrastructure, the stakes can be much higher.

18. So we should not wait for the first major cyber-physical incident to teach us what the safeguards should have been.

19. We should learn now.

The time to build assurance is now

20. The good news is that we have a window.

21. Physical AI is still being tested, trialled and deployed. We are learning how autonomous systems behave in hospitals, airports, transport networks, maritime environments, industrial sites and public spaces.

22. That gives us an opportunity. We can build assurance alongside the technology, rather than retrofit it after an incident.

23. We are seeing the same recognition internationally. A month ago, the US President and leading AI companies announced a voluntary accord that includes stronger internal controls and monitoring, independent external assessment, and board- level oversight of frontier AI systems.

24. The details and approaches will continue to evolve. But the direction is important. There  is growing recognition that, for increasingly capable  AI, testing and assurance cannot be an afterthought.

25. And the lesson applies just as much to physical AI.

26. We should put safeguards in place early. We should test them. We should learn what works. We should adapt them as the technology advances and as we gain experience from deployment.

27. And the time to do so is now.

The risk is not simply more complexity

28. As autonomous systems become more connected, the cybersecurity challenge also changes.

29. Take a  fleet  of autonomous  robots.   If one  robot  is compromised,  the consequences may not stop with that robot. The robots may share information, coordinate tasks and make collective decisions.

30. A compromised sensor, software update or AI model could potentially feed false information into that shared environment. A single compromise could therefore have consequences across an entire fleet.

31. But there is another kind of risk. It does not require a malicious attacker.

32. Agentic AI systems are designed to pursue objectives. They can break a task into sub-goals, choose actions and adapt when circumstances change.

33. That flexibility is what makes them useful. But it can also produce outcomes that were not intended.

34. Imagine an autonomous robot delivering medicine in a hospital. It may decide which route to take, which lift to use, and how to adjust when there is congestion. It may successfully complete its assigned task.

35. But  it could still make a choice that disrupts another part of the hospital’s operations.

36. The system may do what it was asked to do, but not what we intended.

37. This is why autonomous robotics is different. It is not simply more complex. It brings cybersecurity, AI safety, functional safety and operational risk together.

38. And our approach has to evolve accordingly.

Innovation must be matched by assurance

39. Singapore’s approach is clear: innovation must be matched by assurance.

40. First, security must be built in from the start, not added after deployment. Cybersecurity, AI governance and functional safety need to be considered from design and procurement, through testing and deployment, and throughout operations, maintenance and updates.

41. Second, autonomy must not dilute accountability. Even as machines make more decisions, organisations must remain responsible for how those systems are governed, monitored and used.

42. Third, the more autonomous a system becomes, the more deliberately we should define its boundaries.

43. What can it access? What can it change? What decisions can it make on its own? Where must a human step in? And if something goes wrong, how far can it go?

44. This is where the concept of the blast radius matters.

45. We should limit the consequences of failure. Give systems only the access and authority  they need.  Restrict unnecessary  connections. Separate  critical functions. Monitor behaviour continuously. And retain the ability to intervene.

46. The principle is simple: The more capable the machine, the more deliberately we must design its boundaries.

Assurance has to be continuous

47. There is another lesson from recent AI safety discussions. We cannot rely only on what a system is supposed to do. We have to test what it actually does.

48. We need evaluations that probe its capabilities and failure modes. We need monitoring that can detect unexpected behaviour. We need auditability so that when something goes wrong, we can understand what happened. And we need mechanisms to intervene.

49. That is why assurance cannot be a one-time certification exercise. Trust has to be earned continuously.

50. A system that is safe today may face different risks tomorrow as models change, tools change, or as the operating environment changes.

51. This is particularly important for physical AI. The real world is dynamic. Systems interact with people. They  interact with other machines. They encounter circumstances that cannot all be anticipated in a laboratory.

52. So we need to keep testing, monitoring and adapting as these systems evolve.

We need to secure the whole system

53. This also means we cannot think about what a robot can do in isolation.

54. An autonomous robotic system is not just a single robot. It is the combination of the  AI  model,  software,  sensors,  networks,  data,  people and  physical environment in which it operates.

55. A system may appear secure when each component is considered separately, yet behave differently when those components interact.

56. So cybersecurity, AI governance, functional safety and operational considerations cannot be managed in silos.

57. The Cybersecurity Agency (CSA) will therefore develop guidance to help organisations secure autonomous robotic systems across their lifecycle, from design and procurement, through testing and deployment, to operations, monitoring and updates.

58. The intent is practical. We want organisations to ask the right questions early, build the right safeguards from the start, understand where human oversight is needed, and continue testing and improving those safeguards as technology advances.

Singapore can learn before we scale

59. Singapore is well placed to do this.

60. We are a highly connected city. Our digital and physical infrastructure are closely integrated. And we have a strong ecosystem of government agencies, technology companies, researchers and operators

61. Our testbeds, in Singapore, give us a chance to learn in realistic conditions.

62. At the Punggol Digital District, autonomous robots will be tested for deliveries, cleaning and security patrols. At the Jurong Innovation District, autonomous construction equipment is being tested under real site conditions. Our maritime testbeds support trials of autonomous vessels and marine drones.

63. These should not simply be places where we prove that technology works. That is straightforward.

64. What is not so straightforward and more complex is that, for these test beds to be at places where we understand where it can fail, what safeguards work, what happens when systems interact, and what we need to change before we scale those deployments.

65. This is an important opportunity for Singapore.

66. We can learn by doing, safely.

67. And I think our approach can be summed up simply: Test. Assure. Learn. Adapt. Scale.

This is bigger than cybersecurity

68. The challenges ahead will not be solved by cybersecurity professionals alone.

69. A robot can be cyber-secure but still create a safety risk. An AI model can be accurate but still behave unexpectedly. A system can pass a technical test but behave differently in a real operating environment.

70. So we need different disciplines to work together: cybersecurity professionals, AI researchers,  safety  engineers, system  operators,  technology  companies, regulators, and the organisations deploying these systems. That is the ecosystem we are building and nurturing here in Singapore.

71. This is why the work we do here matters.

72. We are not simply developing another set of cybersecurity controls. We are developing a common way of thinking about cybersecurity, AI safety and physical safety together.

Securing our autonomous future together

73. Ultimately, securing smart cities is a shared responsibility.

74. Government has a role to play. We must set the right baseline, develop standards and build capabilities that organisations cannot efficiently build on their own.

75. Technology companies must build security and assurance into the systems they develop, from the get-go, from the outset and not bolted on when an incident has happened.

76. Researchers have a role to play. They must help us understand emerging capabilities and risks. Not just focusing on the here and now, but thinking slightly beyond the horizon on some of the technical; and operational challenges that we need to deal with.

77. Operators, very importantly, must deploy the systems in real world environments and must ensure that systems remain safe in real site conditions, and ultimately be responsible for the trust between them, and the customers they serve.

78. And organisations must remain accountable for how autonomous systems are deployed and used. They come together as an ecosystem, find out what works, find out where it fails, do so safely, responsibly, and work together to ensure those successes can scale beyond Singapore. And that is our common objective.

79. The goal is not to stop innovation.

80. Autonomous systems can help us improve public safety, healthcare, transport, logistics and many other areas. Many benefits for the society and people, especially more so for resource and market-constraint place like Singapore.

81. Importantly, building on these goals together, we must ensure that greater autonomy comes with greater assurance. With that greater assurance, building the trust that we need with people and key stakeholders.

82. Let me conclude by making an observation.

83. We have already seen in the digital world that increasingly capable AI can behave in ways that its creators did not fully anticipate.

84. We are now beginning to put increasingly capable AI into the physical world.

85. We should learn the lessons from the digital world before we experience the physical-world version.

86. We should put safeguards in place early. Test them in realistic environments. Learn from experience. Adapt as technology advances. And keep human responsibility and organisational accountability at the centre.

87. Because a truly smart city is not one where machines simply make more decisions.

88. It is one where decisions can be trusted.

89. And where, when something goes wrong, we retain the ability to understand it, contain it and put it right.

90. The smarter our cities become, the more deliberate we must be about keeping people at the centre and in control.

91. Thank you.