Concerns were raised at a parliamentary audit that increasingly sophisticated hacking attacks using AI are difficult to counter under existing personal data protection systems. With AI automating everything from target discovery to vulnerability analysis, security blind spots could also emerge in the development of AI-based systems by public institutions and in the collection of personal data through external tools.

At an audit held on Oct. 13 by the National Assembly's Political Affairs Committee of the Personal Information Protection Commission and others, Democratic Party lawmaker Min Byeong-deok (민병덕) pressed officials over shortcomings in the AI hacking response system.

Min said about 6 out of 10 personal data leak incidents stem from hacking, and that attack methods have been rapidly growing more sophisticated.

He said, "In the past, attacks used malware or system vulnerabilities, but now AI carries out the entire process of finding targets, analysing vulnerabilities, designing attack routes and stealing authentication information."

He also asked whether AI-enabled hacking is investigated and managed separately in surveys and statistics, and whether systems are in place to detect automated attacks and to run joint drills with relevant agencies. He also questioned whether AI hacking defences are reflected in the personal data protection certification standards for major public systems that will be phased in as mandatory from July next year.

Min said existing measures such as strengthening liability for damages, regular inspections and emergency protection steps have limits in responding to AI hacking threats.

Song Gyeong-hee (송경희), chair of the Personal Information Protection Commission, acknowledged shortcomings in responding to AI hacking and said authorities are preparing measures with relevant ministries.

Song said preventing hacking is an area of security, and explained that the Ministry of Science and ICT oversees the private sector, the National Intelligence Service oversees the public sector, and the Financial Services Commission oversees the financial sector.

She said, "They did not properly manage access rights, did not properly encrypt, and did not detect abnormal traffic," adding that many recent large-scale personal data leaks stem from inadequate basic security measures.

She said authorities will also strengthen rapid information sharing and initial responses among relevant agencies to prevent damage from spreading due to AI hacking.

Security vulnerabilities arising in the development of AI-based systems, not just AI-driven attacks, also came under scrutiny.

Democratic Party lawmaker Park Sang-hyeok (박상혁) said the spread of 'vibe coding', in which developers use AI instead of writing code themselves, could create new security risks such as omitting user authentication procedures.

Park cited personal data leaks at domestic platforms including 29CM and Gangnam Unni, and said similar problems such as abnormal access to application programming interfaces (APIs) could occur at public institutions as well.

He stressed that as more public institutions develop their own systems using AI, there needs to be advance checks for security vulnerabilities as well as developer convenience.

The issue of collecting personal information through external survey tools was also raised.

Park cited findings from a private-sector survey, saying checks of 1,447 official public-institution websites found that 184 of 189 institutions collect personal information using external tools for which security certification could not be confirmed.

He said some cases involve collecting sensitive information such as health data, resident registration numbers and bank account numbers through external tools including Google Forms, and warned that staff reshuffles or poor management of outside contractors could create gaps in information management.

Song said the commission prepared guidance in July to protect personal information in the public sector's AI transition process and will expand its use in the field.

She also said of the management of external contractors, "We will ensure that the institution that outsourced the work is also held responsible, and we will strictly hold them accountable."

The commission plans to strengthen a joint response system with relevant ministries to address new threats including AI-based hacking. Next year it plans to invest 1.4 billion won to launch a pilot project for remotely checking attack surfaces using AI.