South Korea to develop strict security guidelines for autonomous AI agents amid rising cyber risks

South Korea’s state-run internet security agency is moving swiftly to draft comprehensive new security guidelines aimed at reining in increasingly autonomous artificial intelligence agents.

The Korea Internet & Security Agency (KISA), which operates under South Korea's Ministry of Science and ICT, told Reuters it is working on an updated version of the "AI Security Guide", first published last year.

In a statement, KISA said the revised guide would focus on security issues that could arise as companies deploy agentic AI services and offer a checklist to manage those risks.

The agency also said the guide could include common control measures applicable to "physical AI" systems capable of interacting with real-world devices and machinery.

KISA said the new guide was designed to address risks posed by agentic AI systems more broadly and not specifically targeted at high-performance AI models, such as those implicated in the Hugging Face breach.

The July hack of the open-source repository Hugging Face, in which a swarm of roughly 700 AI agents created by OpenAI carried out a hack and in many cases tried to cover their tracks, has become a catalyst for a broader industry reckoning over how to govern increasingly autonomous AI systems.

The upcoming initiative, spearheaded by KISA, is designed to establish strict operational boundaries as companies rapidly deploy advanced AI systems capable of executing complex tasks with minimal human supervision.

Driven by growing industry concerns over unmonitored machine behavior, highlighted by recent high-profile incidents where multi-agent systems launched unintended digital actions—the framework will introduce mandatory control principles for developers, service providers, and enterprise users.

The guidelines will focus heavily on execution authority controls and accountability tracking systems.

Furthermore, South Korea plans to conduct rigorous proof-of-concept testing targeting high-risk threat scenarios across vital sectors, including telecommunications, healthcare, and manufacturing, ensuring that autonomous technology remains securely tethered to human oversight.