Growing AI Security Concerns... Ministry of Science and ICT and KISA Operate Software Vulnerability Reporting Reward Program

A total reward of 50 million KRW to be awarded

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) announced on the 27th that they will operate the 2025 "Software (SW) Security Vulnerability Reporting Reward Program" starting from the 28th to encourage experts to discover security vulnerabilities.

The Ministry of Science and ICT and KISA have been implementing the security vulnerability reporting reward program since 2012 to promote the participation of white-hat hackers (information security experts) who possess extensive knowledge and experience in analyzing security vulnerabilities. The program aims to prevent security incidents exploiting SW security vulnerabilities.

Reward System Diagram.

In particular, this year, as security issues regarding generative artificial intelligence (AI) services such as China's DeepSeek have emerged, the Ministry of Science and ICT pointed out that public anxiety about using AI services is increasing. Accordingly, the reporting of security vulnerabilities related to AI services has been strengthened.

This AI service security vulnerability reporting reward program targets original models of domestic and international open-source AI SW and aims to identify and appropriately address ▲ security vulnerabilities in environments where AI operates (apps, web, etc.), ▲ security vulnerabilities in codes related to AI input/output, and ▲ other security vulnerabilities that could be exploited for security technique bypass or other malicious incidents.

The AI security vulnerability reporting reward program will run for four months from the 28th until June 30. The total reward money of 50 million KRW will be awarded after review by the KISA committee, and the schedule and reward amount may be adjusted depending on the status of report submissions. Any Korean citizen residing domestically or abroad can participate, and reports will be accepted through the "Security Vulnerability Information Portal" website.

Reported vulnerabilities will be forwarded to SW manufacturers to request security measures, and if necessary, public caution notices will be issued through the "Protector Nation" website.

Ryu Jae-myung, Director of the Network Policy Office at the Ministry of Science and ICT, stated, "The development and spread of generative AI is not a choice but an irresistible global trend," adding, "We will raise the security level of AI services by one step and strengthen the discovery and remediation of security vulnerabilities so that the public can use AI services with confidence."