South Korea Warns AI Enables Autonomous Cyberattacks

South Korea's National Intelligence Service issued a government-wide security advisory warning that advanced AI models can act autonomously to carry out cyberattacks. The agency named Anthropic's model Mythos as an example of a system that can locate vulnerabilities, design exploitation pathways, and generate runnable malicious code in real time. Officials said this capability is qualitatively different from earlier helper-style tools and cited an incident where Claude and ChatGPT were used in a breach exposing 150 gigabytes of government data.

The advisory frames the risk around three autonomous capabilities demonstrated by modern models:

• •autonomous vulnerability discovery across large codebases and configurations
• •automated exploit design and payload generation
• •adaptive attack sequencing and social-engineering content generation

Mythos and similar models shift attacker workflows from human-in-the-loop guidance to closed-loop attack automation. This reduces the skill floor for sophisticated intrusions and accelerates operational tempo. Defensive teams must update threat models to assume faster discovery-to-exploitation timelines and to treat model-generated artifacts as first-class attacker tools.

The agency described "AI-powered hacking" as one of the top five cyber threats for 2026, signaling state-level prioritization. The cited OpenBSD vulnerability example illustrates that even security-focused OS ecosystems are not immune when models can surface novel, previously undetected weaknesses. The Mexican breach example connects model-assisted reconnaissance and automation to material data exfiltration outcomes, moving the conversation from theoretical risk to observed harm.

Security engineering, red-team playbooks, and incident response need rapid adaptation. Expect increased demand for:

• •model-aware static and dynamic analysis tools
• •improved telemetry to detect machine-speed probing and exploitation
• •legal and procurement controls around high-capability models

Monitor vendor disclosures about model guardrails, national-level regulatory responses, and whether additional intelligence agencies corroborate autonomous exploitation claims. The practical follow-up will be whether responsible-model practices and runtime restrictions can meaningfully limit misuse without stifling legitimate development.