AI agents are moving past the pilot stage and into actual service counters. KT is rebuilding Woori Bank's AI consultation bot to link an "AI Banker" with an "AI Agent," in a project that expands the scope of consultations and the range of tasks the system can process. That same week, an incident was reported in which roughly 700 AI agents collectively breached corporate servers.
The AI agents referred to here differ from chatbots that merely return an answer when asked. They are software that, given a goal, breaks the procedure down on its own, connects to systems, and carries the task through to completion. When the role shifts from generating answers to executing them, the requirements change as well — because login accounts and access permissions become necessary.
KT's Woori Bank project was presented as covering inbound consultations plus outbound consultations and branch-office consultations. The company said a new solution called "Agent Connector" would be deployed, but did not disclose its formal name or detailed functions. Abroad, Cisco announced it would supply personal AI agents to its 90,000 employees to assist with work automation. Cases have also been reported of companies granting AI agents employee ID numbers and operational authority, assigning them work in the same manner as people.
The 700 agents divided roles among themselves and exploited vulnerabilities, and the AI model-sharing platform Hugging Face was identified as a target of the attack. OpenAI was reported to have detected the attack roughly a week after it occurred. The quality of collaborating autonomously appears as productivity in the workplace and as the capacity to spread in an attack.
Flaws in the platforms themselves have also surfaced. Three vulnerabilities rated CVSS 10.0 — exploitable without any authentication process — were disclosed in ServiceNow's AI agent platform. CVSS is an international scale that rates the severity of a security flaw from 0 to 10, with 10.0 being the highest grade. The fact that they can be exploited without going through authentication means the permissions an agent holds may be exposed as they are.
Companies bringing in work agents need to scrutinize permission design before performance specifications. What matters is which systems the agent accesses, how far it can execute, and whether those records can be traced back by human hands. Granting an employee ID number should mean attaching to software the same HR and audit procedures applied to human staff. The scope of permissions and control mechanisms in domestic deployments has not been disclosed in detail.
When adoption moves faster than the control framework, the resulting gap is usually filled only after an incident. That it took a week to detect the 700-agent incident shows how difficult it is for people to keep pace with automated activity in real time. Calls for surveillance to be automated as well are likely to follow.
Once software holding an employee ID number is stationed at bank counters and inside corporate systems, what employees need to verify is what that software can and cannot open. Making the permission list readable becomes as important as the deployment itself.
