523 vulnerabilities identified in private infrastructure, software, and open source… Reliance on overseas big tech due to lack of budget for AI utilization inspection

304 infrastructure, 135 commercial SW, 84 open source confirmed

There is no separate budget for AI utilization inspection, so we rely on support from overseas big tech.

(Seoul = Yonhap News) Reporter Hayoung Kwon = As a result of the government's inspection of major private information and communication infrastructure, commercial software (SW), and open source from June to the end of September this year, a total of 523 vulnerabilities were found.

This is a result that comes as AI-based cyber threats are growing, such as the use of artificial intelligence (AI) hacking tools in recent financial sector hacking incidents.

◇ 523 vulnerabilities in private infrastructure, software, and open source… Concerns about spreading beyond the financial sector

According to data submitted from the Ministry of Science and ICT by the office of Democratic Party lawmaker Lee Joo-hee, a member of the National Assembly Science, Technology, Information, Broadcasting and Communications Committee on the 6th, 304 vulnerabilities were discovered as a result of an inspection of 16 major private information and communication infrastructure companies (6 large companies, 3 mid-sized companies, 2 small and medium-sized companies, and 5 non-profit organizations).

135 vulnerabilities were identified in 5 companies (1 mid-sized company, 4 small and medium-sized companies) in commercial SW, and 84 vulnerabilities in 144 types of open source. In the case of open source, it is often developed individually or jointly, so the inspection target (development subject) was not specified.

The results of this inspection are attracting attention in conjunction with the recent hacking incident that hit the financial sector.

According to the financial authorities, the Internet address (IP) of the same attacker was discovered in several places in the breaches of seven companies, including Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram, Welcome Savings Bank, and Hyundai Capital.

It was discovered that the attacker carried out a large number of automated attacks targeting multiple financial companies by changing IP addresses.

The National Police Agency is investigating traces of 'ARTEX AI', a large-scale language model (LLM)-based autonomous penetration testing system released as open source on GitHub, focusing on Chinese, in the IP that attacked the bank.

However, private companies often have weaker security than the financial sector, which has a closed network-based security system, and concerns about AI security are spreading beyond the financial sector to industries and companies.

◇ AI vulnerability inspection budget ‘0 won’… Reliance on free programs from overseas big tech

However, it turned out that no separate budget was allocated for private vulnerability inspection projects using AI.

Previously, the Ministry of Science and ICT announced in the 'Private Information Protection Promotion Plan (draft)' reported to the Science and Technology Ministerial Meeting in May that it would establish a joint public-private response system to respond to disclosure of AI vulnerabilities, unify vulnerability and patch management centered on the Vulnerability Management Center within the Korea Internet & Security Agency (KISA), and establish an emergency response system.

At the time, the plan stated that the center would be organized with only 40 people, but would be organized in a way that "preferentially utilizes existing manpower."

However, in reality, vulnerability inspection using Frontier AI is being carried out without a separate budget, and the Ministry of Science and ICT has requested a budget for next year, but has not reflected it in the government plan.

Such vulnerability inspection is possible because the company participates in OpenAI's 'GTAC' program and receives free support for 'GPT-5.5 Cyber', a high-performance security AI model.

The government's unified vulnerability and patch management system is being operated without its own budget and relying on free programs from overseas big tech. Experts point out that as attacks using AI are becoming increasingly mass-scaled and automated, it is necessary to secure a budget for the stable operation of the public-private response system.