Cybersecurity Policy Report, Risks From Agentic AI Outlined by Hong Kong Privacy Regulator, (Mar 19, 2026)
By Tony Foley
The Hong Kong Office of the Privacy Commissioner for Personal Data (PCPD) has issued an alert over the privacy risks associated with OpenClaw and other agentic AI (artificial intelligence).
Agentic AI is more versatile in its functionality than traditional AI chatbots, usually constituting of a tool with high-level access that can be deployed on a local device or server, the PCPD said in a news release.
Among other tasks, agentic AI models can read and write local files, allocate system resources, handle external services, or act autonomously on behalf of the user without requiring their real-time involvement.
The PCPD outlined the higher risks associated with agentic AI, including its default access rights, the additional risks such access poses when there are vulnerabilities in the agentic AI’s system design or safety controls, and potential vulnerabilities that may be introduced if an agentic AI allows users to install plug-ins or skills.
The alert suggests that when collecting, using, and processing data with agentic AI, organizations and individuals should do the following:
Grant the minimum access right to agentic AI;
Use the latest official version of an agentic AI from official channels;
Adopt adequate measures to ensure system and data security;
Install and use plug-ins and skills with caution; and
Conduct continuous risk assessments.
The agency referred organizations to guidance on a model personal data protection framework for use in collecting, using, and processing personal data using AI tools. This guidance may be accessed from the news release.
News: InternationalLegislation DataPrivacy DataSecurity AINews