AI security tools outpace South Korea’s laws

More than 60 leaders from South Korean companies, including people in charge of keeping company information safe, met on Oct. 16 at the Westin Seoul Parnas hotel in Seoul’s Gangnam district. The event was hosted by OpenAI, an American artificial intelligence (AI) company, not a traditional cybersecurity company. OpenAI introduced Daybreak, an AI system that finds weaknesses in computer security and suggests ways to fix them.

AI companies that became famous for making chatbots are now moving into cybersecurity. Anthropic has launched Claude Security, which checks computer code for security weaknesses and helps fix them. Google has introduced Project Fairwind, an AI security tool that only approved organizations can use. South Korean companies are joining in, too. Samsung SDS and cybersecurity company S2W have joined Daybreak. Theori, a company that uses skilled hackers to find security problems legally, is taking part in programs run by OpenAI and Anthropic. On Oct. 8, SK Telecom and Upstage teamed up with AhnLab and other companies to form a group focused on AI security.

It is easy to understand why companies are rushing to make these tools. Hackers are already using AI to search computer systems for weaknesses very quickly and without stopping. One free AI tool for testing computer security is available on GitHub, a website where developers share code. Anyone can download this tool and possibly use it to attack computer systems. Earlier this month, this newspaper tested the tool, which has been connected to attacks on financial institutions, using a practice computer server. The tool broke into the server in less than one minute. People working alone cannot defend against attacks happening this quickly. Security teams now need their own AI tools to find weaknesses before hackers find them.

But South Korea's laws have not kept up with this technology. Article 48(1) of the Information and Communications Network Act says people cannot enter a computer network without permission or go beyond the access they have been given. The law does not protect people who test computer security without permission, even when they are trying to help.

Companies can already use AI to test their own computer systems. They can also test customers' systems when those customers give permission. The AI security group and Daybreak follow these rules. But hackers try every possible way to break into a system, including through business partners and other outside connections. Security testing that imitates a real attack, called penetration testing, is meant to find these possible ways in before criminals use them. However, AI can look for ways into computer systems by itself. While doing this, it might go beyond what the law allows. Even when the goal is to improve security, entering a system without permission can be a crime. This means companies may face legal trouble when they test their defenses in ways that are similar to real attacks.

The government knows there is a problem. This year, it started its first trial program that lets registered white-hat hackers, who find security weaknesses to help protect systems, use AI to test selected computer systems. The program includes seven private companies and eight public organizations. Hackers who report the weaknesses they discover are protected from legal responsibility. But this protection applies only to those 15 organizations. The government will not begin working on wider legal protection for companies and organizations across the country until 2027. It has been careful about changing the rules because making security weaknesses public could hurt a company's reputation. Security testing could also expose people's private information.

The government is also building its own AI system for cybersecurity. But work only started in September, and the system is not expected to be ready until next year. During a parliamentary review on Oct. 15, the Ministry of Science and ICT admitted that its work was already falling behind. After hackers broke into 16 financial institutions, financial regulators announced plans to check for security weaknesses more often. They plan to increase checks from once a year to at least twice a year, starting with large financial institutions. The government also wants to build the systems needed for AI-powered security testing, but it has not set a clear schedule. While AI can search for weaknesses all day and night, the main response so far has been to ask human security testers to do more checks.

During the same parliamentary review, a lawmaker warned that attackers were using advanced AI like a powerful spear, while defenders were still using an old shield from the 20th century. The technology needed to build a stronger shield already exists. What is missing is a clear law that allows people to use it. The government should move quickly to give legal protection to people who test computer security with good intentions. It should also turn the trial program into a permanent system.