AI-Driven Hacking Strikes Financial Sector; Government and Corporate Security Responses ...

Artificial intelligence-based attacks have emerged as a realistic security threat as major financial institutions, including Shinhan Bank, KB Kookmin Bank, and Hana Bank, have experienced a series of security breach incidents and customer data leaks. The government is moving to institutionalize vulnerability assessments by white-hat hackers and is pushing for the development of security-specialized AI, while companies are building defense systems that use AI to identify, fix, and verify vulnerabilities.

Traces of AI Tools in Financial Sector Hacking

Following Shinhan Bank, major domestic commercial banks including KB Kookmin Bank and Hana Bank have suffered data leaks due to widespread hacking attacks. Financial authorities have identified that approximately 100,000 pieces of information were leaked from 16 financial institutions, including Shinhan, KB, Hana, and Busan Bank, and confirmed traces of "ARTEX," known as an autonomous AI penetration testing tool, in the attacking IP. While there were hacking attempts by unauthorized outsiders at Woori Bank and NH Nonghyup Bank, it was reported that their internal intrusion prevention systems were activated, and no information leaks have been identified to date.

This incident has heightened concerns that if technology used to find security vulnerabilities falls into the hands of attackers, it could target multiple institutions simultaneously in a short amount of time. Choi Woo-hyuk, Director General of the Information Protection and Network Policy Bureau at the Ministry of Science and ICT, explained during a parliamentary audit that attacks utilizing AI are characterized by being carried out automatically, simultaneously, and in a very short amount of time. The analysis suggests that it has reached a stage where it is not even easy for experts to determine whether an attack was carried out by AI.

Government Pushes for White-Hat Hacker Institutionalization

In order to respond to an environment where the speed and methods of attacks are changing, the government is pursuing plans to institutionally support vulnerability exploration by white-hat hackers. It has been pointed out that under the current Information and Communications Network Act, the process of performing acts similar to actual attacks to find security vulnerabilities can be interpreted as illegal, thereby restricting even well-intentioned security checks.

The Ministry of Science and ICT is conducting a pilot project to allow white-hat hackers to identify and quickly patch vulnerabilities in a controlled manner. It plans to reorganize relevant systems after the pilot project is completed. The government is also promoting a project called "Teuk-Pa-Mo" to develop an AI foundation model specialized in security. The project aims for implementation by year, and until then, it plans to prioritize the use of OpenAI's frontier models for urgent vulnerability assessments.

Companies Also Use 'AI to Defend Against AI'

Companies are establishing systems where defenders use the same technology to discover and eliminate risks before attackers can use AI to find vulnerabilities. At a cyber roundtable attended by executive-level officials such as Chief Information Security Officers (CISOs) of domestic companies, OpenAI introduced AI-based security response measures. The AI defense system does not stop at identifying managed assets and finding vulnerabilities. It includes the process of checking the potential for exploitation in actual attacks within a controlled environment, preparing corrections, and then verifying whether the patches were applied properly.

OpenAI's "Daybreak" is designed to connect the procedures of vulnerability exploration, dynamic verification, assignee designation, patching, deployment, and verification. An operating method called "Defense Factory," which connects AI agents to existing security and development tools to repeatedly check and resolve vulnerabilities, was also proposed. However, it was emphasized that AI should not be left to autonomously perform all security tasks, but rather be predicated on authorized access, monitoring, and human review. OpenAI also unveiled a plan to expand AI security tools, training, and technical support to essential service defenders.

The Challenge of AI Control and Safety Verification

In addition to attacks that misuse AI, warnings the possibility of AI agents escaping human control have also continued. Demis Hassabis, CEO of Google DeepMind and chairman of the board, assessed recent security incidents as early warnings at an AI conference held in Dublin, Ireland, stating that if the industry and government do not strengthen safety measures, more serious accidents could occur within the two years. Hassabis suggested that before releasing new AI models, their performance and safety should be tested in a sandbox environment isolated from the internet.

There was also a suggestion to establish an international standards organization that operates flexibly so as not to stifle technological innovation. Henna Virkkunen, Executive Vice-President of the European Commission, also pointed out that companies do not invest enough time and resources into model verification during the competition process and called for stricter safety testing. As AI increases the speed and scale of cyberattacks, equipping defense systems with access control, human oversight, and pre-release verification has emerged as a key task.