South Korean security laws lag behind new AI-powered defense tools

The rise of AI security tools

OpenAI recently hosted a gathering in Seoul for over 60 executives to introduce Daybreak, a new defense system. This tool uses artificial intelligence to scan for security weaknesses and provide specific instructions on how to repair them. It marks a shift where companies known for chatbots are now entering the cybersecurity space.

Other major tech players are following a similar path with their own specialized products. Anthropic has released Claude Security to scan source code for flaws, while Google offers a security-focused AI tool called Project Fairwind. These tools are designed to help organizations stay ahead of increasingly sophisticated digital threats.

South Korean companies are actively participating in this new landscape to bolster their defenses. Samsung SDS and the cybersecurity firm S2W have joined the Daybreak initiative, while white-hat hacking firms are working with both OpenAI and Anthropic. Additionally, SK Telecom and Upstage formed a consortium with AhnLab to develop AI-driven security solutions.

The speed of AI-driven attacks

The push for these tools is driven by the fact that hackers are already using AI to probe systems for weaknesses at high speeds. Because AI can scan for vulnerabilities constantly, human security teams are finding it nearly impossible to keep up with the pace of modern attacks. This creates a situation where defenders must use AI simply to remain competitive.

Evidence of this speed was demonstrated during a recent test of an open-source AI penetration-testing tool found on GitHub. This platform allows anyone to download code, which can potentially be used by criminals to launch attacks on various targets. During a test on a practice server, the tool was able to breach the system in less than a minute.

The test results highlight a growing concern for financial institutions, which have already faced several successful hacks recently. Because human defenders cannot manually check every possible entry point as quickly as an AI can, the industry is moving toward automated defense. Security teams are now tasked with finding and fixing weaknesses before an attacker can exploit them.

Legal gaps in current protections

While the technology to defend systems exists, the legal framework in South Korea has not yet caught up to these advancements. Article 48(1) of the Information and Communications Network Act currently prohibits anyone from accessing a network without authorization. However, the law does not provide any specific protections for security testing that is conducted in good faith.

This creates a significant risk for companies that want to use AI to test their own systems or those belonging to their customers. Even if a company has permission to test, an AI might independently find a path into a system that crosses legal boundaries. In such cases, unauthorized access can still be considered a crime, regardless of the intent to improve security.

Companies are currently left exposed to legal risks when they try to simulate real-world attacks to strengthen their defenses. The law does not distinguish between a malicious hacker and a security professional using an AI tool to find a flaw. This ambiguity makes it difficult for firms to adopt the most effective tools without risking legal repercussions.

Slow government response

The South Korean government is aware of this gap but has been moving slowly to address it. This year, the government launched a pilot program that allows registered white-hat hackers to use AI to test systems at 15 specific organizations. These hackers are exempt from liability if they report the vulnerabilities they discover during the process.

Despite this pilot, the government will not begin work on a broader exemption for companies and institutions nationwide until 2027. Officials have been cautious because disclosing vulnerabilities can hurt a company's reputation and might reveal private user data. The government is also building its own AI model for security, but the project only started in the last month and is not expected to be functional until next year.

During a review by the legislature on Oct. 15, the Ministry of Science and ICT admitted that the government's efforts are already behind the curve. To compensate, financial regulators plan to double the frequency of vulnerability checks for large institutions. However, building a permanent infrastructure for AI-powered security testing remains an aspiration without a clear timetable.

A mismatch of shields and spears

The current situation can be described as a mismatch between the tools used by attackers and those used by defenders. At a recent parliamentary audit, a lawmaker warned that attackers are wielding cutting-edge AI as a spear while defenders rely on an outdated, 20th-century shield. This metaphor underscores the fact that the technology for a stronger shield is available now, but the legal basis to use it is missing.

The primary goal for the government is to turn the existing pilot program into a permanent system that covers the entire country. By establishing a clear legal basis for good-faith security testing, the government could allow companies to use AI more freely. This would provide a safer environment for firms to protect their infrastructure against relentless automated threats.

Without these changes, the gap between offensive and defensive capabilities will likely continue to widen. Companies that want to stay secure must navigate a complex landscape where the best tools for the job might also carry legal risks. The speed of AI development means that the window for creating a functional legal framework is closing quickly.