Default privileges of a new user?

[PengXiaoxun]

I create a new account via the following statement:
CREATE USER 'monty'@'%' IDENTIFIED BY '123456';
Without any privileges granted, the user 'monty' can access the database 
information_schema via a remote host.
Why?
How can I create a new user without any privileges actually?