Generative AI is evolving beyond a tool that simply answers questions into an agent that moves between various systems to complete tasks on its own. While this has increased convenience, concerns are also growing that a single wrong decision or abuse of authority could lead to damage across various resources, such as emails, internal documents, payments, and development environments.
The Korea Internet & Security Agency (KISA) announced that it is developing a revised version of its existing AI security guidelines to reflect these changes. The revised version will focus on a security checklist and common control measures that companies should review when adopting agentic AI.
The final guidelines haven't been released yet. Therefore, what has been confirmed so far are the direction of the revisions and the scope of the review; we'll have to wait for a future announcement for the specific control items and the publication schedule.
| Why Is Existing Generative AI Security Alone Insufficient?
Typical chatbots often stop at simply answering users' questions. In contrast, agentic AI can be given a goal, formulate a plan, invoke external tools, evaluate the results, and then proceed to the next action. The key difference is that it performs multiple steps without requiring continuous human verification.
In this structure, it's not enough to simply check the safety of the input values. What permissions does the agent have, which systems can it access, and who can stop it while it is running?, We need to work together to ensure that every action is logged. This is because even a small error can quickly snowball through automated workflows.
| Checklist for Businesses to Be Included in the New Guide
The revision plan announced by KISA includes a security checklist that companies should review when implementing AI agents. Although the specific items have not yet been disclosed, it is highly likely that the checklist will cover the entire lifecycle—from pre-implementation risk assessments to monitoring during operation and incident response.
In practice, It is important to first define the agent's purpose and permitted scope of work, and then grant only the minimum necessary permissions. Connections to external services, the handling of sensitive information, human approval steps, the retention of execution logs, the detection of anomalous behavior, and emergency shutdown mechanisms are all areas that need to be reviewed as well.
| Why Common Control Measures Are Important
Although each agent’s tasks and tools vary, there are certain safeguards that are always necessary. These include distinguishing between user and system command priorities, preventing untrusted external content from acting like internal commands, and A typical example of such a control is requiring additional approval before taking important actions.
Furthermore, rather than simply recording the agent's judgment, We need to be able to track which data sources were referenced and which tools were called. To reconstruct the cause of a problem and quickly identify the affected resources when an issue arises, an auditable record is necessary. Common control measures serve to establish this baseline across the entire industry.
| The scope that could extend to Physical AI
KISA is also reviewing common control measures for Physical AI, which is connected to actual devices and machinery. Unlike agents that operate solely within software, errors in AI connected to robots, production equipment, and mobile devices can lead to operational disruptions or safety issues in the physical world.
In this case, not only network security but also Physical safety design measures—such as limiting the range of motion, transitioning to a safe state, taking manual control, and verifying the integrity of sensors and commands—are also necessary. However, it has not yet been determined to what extent Physical AI will be included in the final revised edition.
| What Companies Can Do to Prepare Starting Now
Even before the guide is released, companies can start by compiling a list of AI agents currently in operation or undergoing testing. If there are so-called “shadow AI” agents—where individuals or teams connect to external agents without the relevant department’s knowledge—the first step is to identify what data and accounts they are accessing.
Next, It's a good idea to separate read and write permissions and require human approval for actions that are difficult to undo, such as deletion, transfers, and distribution. We must also establish procedures to repeatedly verify malicious inputs and incorrect tool calls in a test environment, and to immediately terminate the agent’s session and revoke its credentials if any suspicious activity is detected.
| What We've Covered So Far and What's Next
It has been confirmed that KISA is revising its AI security guidelines to address the security risks posed by agentic AI and is preparing a checklist for businesses and common control measures. "Physical AI" is an item currently under review for inclusion; its final inclusion has not yet been confirmed.
Going forward, the key considerations will be the final publication date, the scope of application, sector-specific guidelines, and how the guidelines will integrate with existing personal information and information security management systems. From a corporate perspective, rather than waiting for the guidelines to be released, It’s more realistic to start by implementing the four basic controls: least privilege, human approval, audit trails, and immediate termination.
Tags
#KISA #Korea Internet & Security Agency #Agentic AI #AI Agent #AI Security #Cybersecurity #Security Guide #PhysicalAI #Information Security #AI Governance #Enterprise Security
