Korea University professor warns of 'vulnerability storm' from AI at AIS 2026

Kim Seung-joo, a professor at Korea University's Graduate School of Information Security, warned that AI is accelerating flaw discovery faster than fixes and updates can follow, describing the result as a "vulnerability storm." He spoke in a keynote titled "The Era of AI Vulnerability Discovery, Rebuilding Security Strategy" at the 2026 AI Security Conference (AIS 2026), held on November 3 at the Korea Science and Technology Center in Seoul with about 700 security professionals attending, according to DailySecu.

Kim described ARTEX, an AI-based penetration testing tool, as linking multiple AI models to carry out reconnaissance, vulnerability discovery and attack execution. He argued that falling attack costs make small or peripheral systems — previously ignored because they were not profitable to attack — viable targets. Financial-sector incidents tied to ARTEX involved systems used by loan recruiters, sales staff and partner companies that are open to external access rather than internal work networks, he said.

For defense, Kim said asset identification must go beyond counting servers to cover virtual machines, OS and software versions, end-of-support products and patch status. He added that in-house closed AI is not automatically sufficient and must be judged on its detection and analysis capability, citing the AI Cyber Challenge (AIxCC) as evidence that orchestrating LLMs with fuzzers and static analysis tools matters as much as the choice of model.

Frameworks, resilience and support for smaller firms

Kim said data classification and controls under the National Network Security Framework (N2SF) are a condition for using external AI and cloud services. He compared uniform network separation to trying to keep an entire hospital sterile, warning that it drives workaround connections the organization may not even know about. He presented the Risk Management Framework (RMF) as a way to prioritize security spending by risk, and described Zero Trust as a principle for limiting post-intrusion spread across users, devices, applications and data.

He defined cyber resilience as maintaining core operations, giving the example of continued care via paper records if a hospital's EMR system goes down. Requirements across frameworks such as NIST CSF, security controls, RMF and Zero Trust need clearer mapping in Korea, he said. Kim also called for encouraging legitimate white-hat vulnerability research and for a patch deadline requiring vendors to provide security updates within a set period by risk, and described accumulated vulnerabilities and poor management as "security debt" that must be actively sought out and fixed.

On policy, Kim said sovereign AI should be developed mid- to long-term for national security, while private firms should quickly find vulnerabilities using available commercial tools. He called for vouchers and other support so small and medium-sized enterprises can use such tools, and said institutionalization should be sped up and technology upgraded to raise Korea's security level in a short time. Previously, hacking required several attackers working together, but AI tools now let one person do it.