AI Hacking Era Triggered by Anthropic's Mythos: Security Industry Focuses on Encryption and Zero Trust

Anthropic's next-generation artificial intelligence (AI) model, Mythos, has revealed its potential for detecting software vulnerabilities and automating attacks, prompting the domestic security industry to enhance its response strategies. Industry experts note that while AI is not creating new hacking methods, it is significantly accelerating the speed of vulnerability exploration and attack execution. As a result, there is a shift from a preemptive security framework to one that emphasizes automated detection and response, data encryption, and zero trust-based security.

On May 11, Ryu Je-myung, the Second Vice Minister of Science and ICT, met with Michael Selitto, Global Policy Lead at Anthropic, to discuss collaboration in the AI and cybersecurity sectors. The government is reportedly exploring the possibility of securing access to Mythos and participating in Project Glasswing.

Mythos is a high-performance AI model capable of understanding and analyzing complex software to identify vulnerabilities. Its ability to detect vulnerabilities has raised global concerns about AI security, especially as the potential for exploitation becomes apparent. The government is considering applying Mythos to real systems and infrastructure to identify vulnerabilities and validate defense mechanisms as part of its interest in Project Glasswing.

The domestic security industry views the concerns surrounding AI security as a foreseeable issue. They have been preparing for hacking scenarios resulting from AI advancements, and the recent Mythos shock has heightened awareness of AI security threats.

Experts analyze that new attack techniques have not emerged due to Mythos; rather, the speed and level of automation in exploring and attacking vulnerabilities have significantly increased through AI. The methods of exploiting vulnerabilities, executing malware, and carrying out commands remain largely unchanged from traditional hacking techniques. However, the speed, repetitiveness, and sophistication of attackers' explorations have risen, necessitating a shift in corporate response strategies.

Consequently, security strategies are evolving from a focus on preemptive blocking to prioritizing rapid detection, analysis, response, data encryption, and zero trust principles.

AhnLab views the Mythos shock as a pivotal moment for the security industry to transition to new defense systems. The ability to quickly identify and analyze emerging threats for swift response has become crucial, rather than attempting to block all attacks in advance.

The industry believes that AI should be recognized not just as a tool but as an active agent, and that AI security must expand to encompass the identification and control of AI actions in the future.

Fasoo AI emphasizes minimizing damage after data breaches. As AI-based attacks become more sophisticated, it is increasingly unrealistic to prevent all breaches. Therefore, encryption is vital to ensure that even if data is leaked, attackers cannot access or exploit its contents.

A Fasoo AI representative stated, "We protect data itself through our enterprise document and data encryption solution, FED (Fasoo Enterprise DRM), and our data identification and classification solution, FDR (Fasoo Data Radar)."

SGA Solutions explains that AI-based attacks often target data theft, making database access management and control, as well as preventing lateral movement between servers, essential. An SGA Solutions representative noted, "To achieve this, it is important to strengthen micro-segmentation in server security and expand security frameworks based on zero trust architecture."

However, there are concerns that the domestic security industry faces limitations in verifying actual threat levels and enhancing response systems. This is due to the difficulty in gaining direct access to restricted AI security research projects like Mythos. Consequently, domestic security companies must focus on strengthening their own AI security capabilities and automation systems.

* This article has been translated by AI.

Shin Hye An