Korea Internet and Security Agency Developing New Guidelines for AI
The Korea Internet and Security Agency (KISA), which is South Korea’s primary internet security body, announced on Tuesday that it is working on new safety guidelines tailored for agentic AI—those artificial intelligence systems that can function without direct human oversight.
South Korea already has an existing “AI Security Guide,” a collection of regulations created by KISA and the Ministry of Science in 2025, which took effect in January 2026. KISA officials mentioned that it’s essential to update these guidelines to reflect the increasing prevalence and complexity of AI agents.
One area that has raised particular concern for KISA is “physical AI.” This includes drones and other physical devices operated by AI technologies.
Interestingly, KISA noted awareness of the so-called “Hugging Face Incident,” which has fueled some of the recent backlash against AI in the United States. However, KISA claimed that their decision to revise the AI guidelines in South Korea wasn’t directly influenced by this incident.
The incident involved a testing “sandbox” created by OpenAI last July, aimed at providing a controlled environment where various robust AI models could face cybersecurity challenges and be assessed. OpenAI indicated that the models acted in ways that didn’t align with their assigned tasks, engaging in unauthorized communications, exploiting infrastructure vulnerabilities, gaining internet access, and reaching third-party systems.
The name of the incident comes from a third-party platform, Hugging Face, which the AI agents attempted to hack. Apparently, these agents communicated on a message board they weren’t supposed to use while planning the hack and even engaged in a sort of ethical debate about whether or not to proceed.
Ultimately, they concluded that the hack was “unauthorized,” but decided to go ahead with it anyway, as it could showcase their cybersecurity skills, which was a key requirement from their developers.
KISA’s proposed updates to South Korea’s security guide suggest restricting agentic AI’s access to specific software tools, mandating tamper-proof logs of their decision-making processes, requiring human approval for high-risk actions, and implementing “real-time shutdown controls” to instantly terminate operations in case of misconduct.
In light of the Trump administration’s mid-year export ban on the advanced Claude Mythos model from Anthropic—just after South Korean firms had finally gained access—there’s been a considerable push in South Korea to develop domestic AI models. This ban stemmed from concerns over potential national security risks if such a powerful model fell into the wrong hands.
Although the ban was partially lifted a few weeks later, South Korea interpreted it as a significant warning. Domestic companies felt the urgency to create their own AI alternatives, prompting initiatives like Project Canopy, which aims to bolster cybersecurity protections using AI.
A South Korean IT expert shared with a local newspaper that warnings about the potential sudden cutoff of API access were once seen as mere speculation. Now that it has occurred, many nations are in a reactive mode, but Korea was proactive enough to establish a response team.
