KISA analyst warns AI now runs most attack tasks, urges stronger defenses

Kim Do-won, team leader of KISA's AI Comprehensive Analysis Team, outlined AI-era cyber threat trends and countermeasures in a talk at AIS 2026 on November 3, 2026, at the Korea Science and Technology Center in Seoul, according to Daily Secu.

The conference was hosted by Daily Secu and sponsored by KISA and KISIA, with about 700 security staff and officials attending.

Kim described Anthropic's November 2025 disclosure of an espionage campaign attributed to a China state-backed group that targeted about 30 organizations. In that campaign, AI performed 80-90% of attack tasks, while a human approved 4-6 key decisions per campaign.

In the talk, Kim also noted signs that attackers discuss or attempt to exploit vulnerabilities within hours of disclosure using open-source AI attack tools, along with malware that uses LLMs at runtime. He cited a domestic incident in which missing API authorization checks on logged-in users' request values allowed access to other users' data, and an attack in which a developer's source code repository access key was stolen and operations server credentials embedded in code were used to reach customer data.

KISA's K-Hunter was presented as a system that combines data preprocessing, suspicious-indicator screening, AI autonomous analysis and analyst verification.

Kim recommended multi-factor authentication, shorter session validity, key detection and rotation, least privilege, backup deletion rights separated from operations with separate MFA, immutable and offline backups, and regular recovery drills.