South Korea's AI Agent Security Guide: Govern Capabilities, Not Labels

What KISA has announced

Reuters reported that KISA, an agency under South Korea's Ministry of Science and ICT, is revising an AI Security Guide first published in 2025. The new version is expected to address risks arising as companies deploy agentic AI and to include a security checklist. It may also set out common control measures for physical AI that interacts with devices or machinery.

This is development work, not a completed standard. Reuters said the guide is not specifically aimed at high-performance frontier models, and KISA has not yet published the final checklist. Businesses should therefore treat the announcement as a signal about security architecture, not as evidence of compliance or a new legal obligation.

KISA's broader direction is already visible. On 7 July 2026 it published an AI Security Threat Response Manual covering AI-specific threat classification and diagnosis, industry threat scenarios and responses. OWASP's Top 10 for Agentic Applications 2026 likewise focuses on systems that plan, act and make decisions across workflows. The shared message is that agent security extends beyond model output quality.

Agent risk changes with capability

The word 'agent' is too broad for approval. One system may only answer questions from an approved knowledge base. Another may read customer records, draft an email, alter a database, make a payment or control machinery. They should not inherit the same risk rating because they share a label or model.

Risk rises with authority, reach and reversibility. A weak answer from a read-only assistant can mislead a person. The same failure in a write-enabled agent can corrupt records; in an execution agent it can trigger an external commitment; in physical AI it can affect equipment and safety. Security reviews should therefore bind controls to capabilities and consequences.

Use a six-level capability matrix

Classify each deployed workflow at its highest enabled level:

• Chat: generates an answer but has no tools. Control grounding, disclosure, data handling and output evaluation.
• Read: retrieves from bounded systems without changing them. Add least-privilege identity, source allowlists, query limits and access logging.
• Draft: prepares an action for a person to release. Make the approval object, evidence and intended recipient visible before submission.
• Write: changes data in a limited, reversible scope. Enforce field and record boundaries, rate limits, validation and tested rollback.
• Execute: creates external effects such as publication, purchasing or access changes. Add spend and recipient limits, dual approval for high-impact actions, idempotency and reconciliation.
• Physical: influences devices or machinery. Require independent interlocks, local stopping controls, safe-state behaviour and testing outside the model's own decision loop.

Attach controls to the highest consequence

Record the level in the service inventory, alongside the model version, connected tools, data classes, credential owner and accountable human. Reassess it whenever a connector, permission or automation step changes.

For each level, test the failure that matters most. Can untrusted content redirect the agent? Can it cross tenant or data boundaries? Can it select the wrong recipient, repeat an irreversible action or claim success when the external system failed? Can an authorised person stop it without relying on the model to cooperate?

Evidence should include denied-action tests as well as successful paths. Keep durable records of the instruction, retrieved context, tool call, approval, external response and final state. Separate emergency stopping and safety interlocks from the agent itself.

What business leaders should do next

Ask every AI owner to replace the single 'agent' category with the six-level capability profile. Freeze deployments whose actual authority is unclear. Set a minimum control set for each level, then require a new approval when the system moves upward or gains a higher-consequence tool.

KISA's final guide may provide a useful national checklist, but businesses do not need to wait to adopt the underlying principle. ELYMENT AI's earlier analysis of frontier AI control assessments, human approval workflows and physical AI standards offers deeper frameworks for these layers. ELYMENT AI can help turn a mixed portfolio of copilots, agents and physical systems into a capability inventory with evidence-based release gates.

Sources

• Reuters: South Korea to develop new security guidelines for autonomous AI agents (15 September 2026) - Independent reporting on KISA's work to update its AI Security Guide for agentic services, including a checklist and possible physical AI controls.
• KISA: AI Security Threat Response Manual (7 July 2026) - Primary publication describing KISA's AI-specific threat classification, diagnosis, industry scenarios and response guidance.
• OWASP: Top 10 for Agentic Applications for 2026 (9 December 2025) - Independent security framework for autonomous and agentic systems that plan, act and make decisions across workflows.

Continue learning

• Assess frontier AI controls before agent deployment
• Design human approval into agent workflows
• Build independent safety controls for physical AI

Frequently asked questions