South Korea is developing an AI agent security guide for systems that can make decisions, call tools and act with limited human supervision. The Korea Internet & Security Agency said on September 15 that it is updating the national guidance first published last year.

 

The KISA revision is expected to add three elements:

  • A checklist for managing agentic AI security risks
  • Controls for autonomous access and tool use
  • Possible safeguards for physical AI connected to machinery

 

Related Research

 

South Korea Develops AI Agent Security Guide

KISA operates under South Korea's Ministry of Science and ICT. The agency told Reuters that the revised guide will focus on security problems created when businesses deploy agentic AI services, rather than targeting one model maker or one class of high-performance systems.

 

That distinction matters because agents create a different security boundary from ordinary chatbots. A chatbot generally returns text to a person; an agent may retrieve files, invoke software, write to databases or send instructions to other systems before a person reviews every intermediate step.

 

The announced checklist could turn that difference into concrete operating questions. Organizations will need to decide which tools an agent may use, what data it may reach, which actions require approval and how investigators can reconstruct an automated decision after an error or attack.

 

KISA has not published the finished revision or a release date. Its description therefore sets the scope, not final requirements. Details such as mandatory controls, sector-specific rules and whether the document will remain advisory have yet to be disclosed.

 

KISA's Checklist Will Follow Agent Actions

The central challenge is delegated authority. An autonomous system can hold credentials and move between planning and execution, so a malicious instruction hidden in a webpage or document can become more consequential than a bad answer displayed in a chat window.

 

A useful checklist must follow the entire chain: the source of an instruction, the model's proposed action, the permission granted to the agent, the tool that executes it and the record retained afterward. Limiting only the model leaves connected accounts and downstream software exposed.

 

Controls likely to matter include least-privilege identities, allowlisted tools, bounded spending or transaction limits, human approval for irreversible actions, tamper-resistant logs and a shutdown path outside the agent. KISA has not confirmed that exact list, but each measure follows directly from the risks its announced scope is designed to manage.

 

The guide could also give Korean companies a common vocabulary for vendor reviews. Buyers need comparable evidence about an agent's permissions, memory, data retention, model changes and incident response, especially when the service crosses cloud providers or combines tools from several suppliers.

 

Physical AI Extends Security Into Machinery

KISA said the updated guidance could include common control measures for physical AI, meaning systems able to interact with real-world devices and machinery. That broadens the risk from information exposure to operational consequences such as unsafe movement, disrupted production or commands sent to the wrong equipment.

 

Physical systems also complicate recovery. A software agent can sometimes be paused or rolled back, while a connected machine may retain momentum, hold material or operate near workers. Security controls must therefore connect identity and network policy with physical interlocks, safe states and local overrides.

 

The possible inclusion of physical AI makes the project relevant to South Korea's manufacturing, robotics and automotive industries, not only software companies. It may also help align teams that traditionally separate cybersecurity, functional safety and industrial operations even though autonomous agents can cross all three domains.

 

KISA Builds on Its 2025 Guide and Red-Team Program

KISA's original AI Security Guide was published on December 10, 2025 to help companies and the public protect AI models and services from external cyber threats. The agency redistributed a corrected edition and errata on March 13, 2026.

 

In July, KISA released a separate AI security red-teaming guide covering team formation, preparation, execution and reporting. That document addressed how organizations test AI systems, while the new agent-focused revision is positioned to address the operational authority those systems receive.

 

KISA is also applying agents on defense. Its September cyber-exercise program will pilot AI agents that generate website-specific penetration scenarios, supplementing manual testing by white-hat hackers. Participants will receive response guidance and current incident material after the exercise.

 

Taken together, the publications and exercises show a policy program moving from general model security toward deployment controls, adversarial testing and autonomous action. The decisive test will be whether the revised guide gives developers and operators controls they can verify rather than broad principles they can merely acknowledge.

 

Companies deploying agents need not wait for the final document to map identities, permissions, tools and physical consequences. When KISA publishes the revision, its checklist will reveal whether South Korea intends to establish a baseline that procurement teams, auditors and regulators can apply consistently across sectors.