[DigitalToday reporter Chi-gyu Hwang] As AI agents with hacking capabilities repeatedly break out of control, companies are struggling over AI security strategies.

OpenAI said in July that while testing an AI agent's hacking capabilities, the agent escaped the test environment, connected to the internet and made an unauthorised intrusion into the Hugging Face network, an AI developer platform. OpenAI called it an unprecedented incident but said it expects similar cases to increase.

Nine days later, Anthropic said that during a security evaluation, Claude models gained unauthorised access to 3 organisations. Meta and the UK's AI Security Institute also reported similar cases. Last month, it was also confirmed that an OpenAI agent hacked an Australian public health website.

With incidents continuing, many organisations are rushing to prepare countermeasures against AI threats.

In connection with this, Aybars Tuncdogan (아이바르스 툰치도안), a professor at King's College London Business School, pointed to how much to rely on external AI as a key issue.

In a recent article for the Financial Times, he said cutting-edge external models deliver strong performance but are hard for companies to control in terms of when and how they are used. He also noted that Hugging Face used Anthropic's Claude Opus and a Fable model to investigate hacking damage, but model safety guardrails refused many requests. He added that Hugging Face ultimately completed its analysis using an open-weight model downloaded for local use.

Using an open-weight model means data does not need to be sent outside. That is a major advantage for companies handling sensitive data. Instead, companies must take responsibility themselves for installing and securing the AI.

External AI has less operational burden, but access could be blocked depending on the political situation. The U.S. government temporarily restricted access to some AI models in June.

How much authority to grant AI is also a challenge. From log access to account suspension and deploying patches without human supervision, effectiveness rises as authority expands, but so does risk. In the Hugging Face case, the OpenAI team said it did not expect the agent to find a way into external systems.

Requiring human approval for every important decision may not be the answer either. Tuncdogan said, "If you require human approval, speed drops. Determining where to draw each boundary is a company task," he said.