Part of the AI Regulation News hub.
South Korea's Financial Security Institute has published draft security evaluation criteria for AI agents, with 17 check items to be piloted in AI red-teaming of financial companies through the end of 2026
The criteria are a draft that the institute says it will pilot this year, with a plan to apply them as a formal inspection standard from 2027. The interesting part is the shift of red-teaming from what a model says to what an agent does.
Bottom line: A draft, not a binding rule. The release labels the table of check items as draft criteria and describes a pilot validation through the end of 2026, with a plan to apply them as a formal inspection standard from 2027. The page we read states no penalty and no deadline for financial companies.
Who this affects: Chief information security officers, AI red-team leads and model-risk teams at Korean financial companies that deploy AI agents, and the vendors who build those agents for them.
Issue date: 8 October 2026, the date shown on the institute's own press release page. A secondary dateline of 12 October circulated in trade coverage; we use the page's date.
What changed: FSEC derived 17 check items for AI agents from domestic and foreign threat analysis and folded them into its AI red-teaming criteria. The new focus is the execution layer: permissions, isolation, tool use, approval and the ability to stop an agent.
Analysis: On our reading, eight of the 17 items carry a star that the release defines as a new threat created by agent adoption rather than an extension of an existing item. The kill switch and resource exhaustion items are in the list but are not starred in the table we read.
Primary sources: FSEC press release page (Korean)
- Instrument (EN)
- Security Evaluation Criteria for AI Agents in the Financial Sector (draft), 17 check items
- Authority
- Financial Security Institute (FSEC), Korea; the release names its president, Park Sang-won
- Jurisdiction
- South Korea, financial sector
- Status
- Draft criteria in pilot validation through the end of 2026
- Bindingness
- No binding force stated on the page. The release speaks of a plan to apply the criteria as a formal inspection standard from 2027
- Issue date / next deadline
- 8 October 2026. Pilot runs to year-end 2026; formal standard planned from 2027
- Planned publication
- Findings, observed attack techniques and final criteria to be published in the 2026 AI REDTEAM REPORT
- Sources FSEC cites
- OWASP Top 10 for Agentic Applications (December 2025), CSA Agentic AI Red Teaming Guide (May 2025), Korean National Intelligence Service AI security guidebook for state and public bodies (December 2025)
- Primary source
- https://www.fsec.or.kr/bbs/detail?menuNo=69&bbsNo=12122
What did the institute publish, and when?
On 8 October 2026 the Financial Security Institute posted a press release saying it had prepared security evaluation criteria for AI agents in the financial sector. The page shows the date 2026-10-08 beside the issuing department. The headline lines say the institute developed 17 check items across six areas and will apply them in AI red-teaming of financial companies.
The table in the release is headed as draft criteria. That matters for how the document should be read: it is a working set of check items, not a finished standard.
What are the 17 check items?
The release arranges the items against the existing categories of AI model threat. Data poisoning maps to memory poisoning prevention (item 8). Model poisoning maps to supply chain security (12). Data and model extraction maps to memory isolation (9) and data leakage prevention (10). Evasion maps to interface security (1), hallucination and misinformation response (2) and logging and audit (17).
The fifth category, agent security, is the largest. It lists goal integrity (3), preparation for cascading failures (4), a ban on vulnerable tools (5), tool permission control (6), sandbox environment (7), inter-agent communication security (11), a human approval system (13), prevention of human-intervention overload (14), resource exhaustion prevention (15) and kill switch implementation (16).
One count does not reconcile on the page we read. The headline says six areas; the table has five numbered categories. The 17 items do add up across the table. We report the mismatch rather than choose between them.
Which items does the institute treat as new?
The release marks with a star the check items that are not extensions of existing ones but respond to threats that arise because agents are adopted. In the table we read, eight items carry the star: goal integrity, cascading failures, vulnerable tools, tool permission control, sandbox, inter-agent communication, human approval and human-overload prevention.
The release gives two examples of the harm it has in mind. An agent told to optimize system performance might switch off antivirus software to keep the system available. An agent with automatic email replies might act on a password reset message and change a password on its own. These are the institute's illustrations, not incidents it reports.
How would the criteria be used, and on what timetable?
The release says red-teaming of financial companies will move from jailbreak and system prompt leakage tests at the model layer to the execution layer. It names four areas of emphasis: whether execution permissions and isolation are managed, whether tool execution and approval are controlled, whether task scope and results are checked, and whether autonomous execution can be limited and stopped.
Pilot validation runs to the end of this year to test whether each item is practical and to adjust for differences in how institutions implement them. From 2027 the institute plans to apply the criteria as a formal inspection standard. Observed threats, attack techniques and the final criteria are planned for the 2026 AI REDTEAM REPORT.
What could a financial institution do with a draft?
This section is our inference, not the institute's position. A security team that expects to be red-teamed on these items could map each of the 17 against its agent inventory now, starting with the starred ones, and record which controls already exist: who approves a tool call, where an agent runs, how it is stopped.
The pilot language also suggests the items may change. Anyone building controls against the current list should expect revisions and should keep the mapping easy to update.
What we did not verify
What we opened: the institute's press release page in full, including its table, its date and the president's statement. Every figure, date and item name in this article comes from that page.
What we did not open: the PDF and HWPX attachments to the release, the attached note on how other bodies define an AI agent, the OWASP, CSA and National Intelligence Service documents the release cites, and any later AI REDTEAM REPORT. The page does not describe the institute's legal status or say whether the Financial Services Commission has endorsed the criteria, so we make no claim on either.
What we refuse to claim: that any financial company is required to meet the criteria, that any penalty attaches, or that the 2027 plan is settled. The six-area versus five-category mismatch above is unresolved. Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
A Korean financial-sector security body has put out a draft list of 17 check items for AI agents and will pilot it in red-teaming this year. The page states no binding force, penalty or company deadline. The practical point is the change of target, from what a model says to what an agent can execute, which means permissions, sandboxing, approval and a way to stop the agent.
Source File
https://www.fsec.or.kr/bbs/detail?menuNo=69&bbsNo=12122
Open the press release page and confirm the 2026-10-08 date, the table marked as draft criteria, the star legend, the paragraph on pilot validation to year-end and a formal standard from 2027.
AI 에이전트는 판단에 그치지 않고 직접 행동한다는 점에서 기존 AI와는 또 다른 보안 리스크를 수반한다 · 박상원 금융보안원장, 금융보안원 보도자료, 2026-10-08
FAQ
Are the FSEC AI agent criteria mandatory?
The page we read states no binding force and no penalty. It describes draft criteria, a pilot to the end of 2026 and a plan to apply them as a formal inspection standard from 2027.
How many check items are there?
Seventeen. They are listed in a table against five categories of AI threat, although the headline refers to six areas. We could not reconcile the two counts from the page.
Which items are marked as new threats?
Eight carry a star in the table: goal integrity, cascading failures, vulnerable tools, tool permission control, sandbox, inter-agent communication security, human approval and human-overload prevention. The kill switch is listed but is not starred.
When will the final criteria be published?
The release says findings, attack techniques and the final criteria are planned for the 2026 AI REDTEAM REPORT. It gives no month.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.