More than 60 executives from South Korean companies, including chief information security officers, gathered Oct. 16 at the Westin Seoul Parnas in Seoul’s Gangnam district. The host was OpenAI, the U.S. artificial intelligence company, rather than a traditional cybersecurity firm. OpenAI introduced Daybreak, an AI-powered defense system designed to find security vulnerabilities and suggest ways to fix them.AI companies that built their reputations on chatbots are now making inroads into cybersecurity. Anthropic has launched Claude Security, which scans source code for vulnerabilities and helps fix them. Google has introduced Project Fairwind, a security-focused AI tool available only to vetted organizations. South Korean companies are also getting involved. Samsung SDS and cybersecurity firm S2W have joined Daybreak, while white-hat hacking firm Theori is participating in programs run by OpenAI and Anthropic. On Oct. 8, SK Telecom and Upstage formed an AI security consortium with AhnLab and other companies.The rush to develop these tools is hardly surprising. Hackers are already using AI to probe systems for weaknesses at relentless speed. An open-source AI penetration-testing tool available on GitHub, a platform where developers share code, can be downloaded by anyone and potentially used to launch attacks. Earlier this month, this newspaper tested the tool, which has been linked to attacks on financial institutions, on a practice server. The server was breached in less than a minute. Human defenders simply cannot keep up. Security teams now need AI of their own to find weaknesses before attackers do.The law, however, has yet to catch up. Article 48(1) of the Information and Communications Network Act prohibits anyone from accessing a network without authorization or exceeding the scope of their permitted access. It offers no legal protection for security testing conducted in good faith.Companies can already use AI to test their own systems or those of customers who have given permission. The security consortium and Daybreak operate within those boundaries. But hackers look for any way in, including through business partners and other external connections. Penetration testing is meant to uncover those routes before criminals exploit them. AI can search for a way into a system on its own, however, and may cross legal boundaries in the process. Even when the aim is to strengthen security, unauthorized access can constitute a crime. That leaves companies exposed to legal risks when they try to test their defenses under conditions that resemble real attacks.The government acknowledges the gap. This year, it launched its first pilot program allowing registered white-hat hackers to use AI to test designated systems at seven private companies and eight public institutions. Those who report the vulnerabilities they find are exempt from liability. But the protection covers only those 15 organizations. Work to establish a broader exemption for companies and institutions nationwide will not begin until 2027. The government has been cautious because disclosing vulnerabilities could damage a company’s reputation, while testing itself could expose personal information.The government is also developing its own security-focused AI model, but work did not begin until September, and the system is not expected to be ready until next year. At a parliamentary audit on Oct. 15, the Ministry of Science and ICT acknowledged that the effort was already behind the curve. After 16 financial institutions were hacked, financial regulators announced plans to increase vulnerability checks from once a year to at least twice a year, starting with large institutions. Building infrastructure for AI-powered security testing remains an aspiration without a firm timetable. As AI scans for weaknesses around the clock, the main response has been to ask human testers to check more often.At the same parliamentary audit, a lawmaker warned that attackers were wielding cutting-edge AI as a spear while defenders relied on an outdated, 20th-century shield. The technology for a stronger shield already exists. What is missing is a clear legal basis for using it. The government should act quickly to protect good-faith security testing under the law and turn the pilot program into a permanent system.
Click Here For The Original Source.
——————————————————–
