0
A conceptual image illustrating the risk of artificial intelligence being exploited for cyberattacks. The Japanese government is strengthening defenses for critical infrastructure, including finance, electricity, and telecommunications, in response to advanced AI's capabilities in detecting security vulnerabilities and launching attacks. / Photo courtesy of Getty Images Bank

The Japanese government is strengthening cyber defenses for critical infrastructure, including finance, electricity, and telecommunications, in response to the emergence of advanced artificial intelligence (AI) capable of autonomously identifying software vulnerabilities and generating exploit codes. This shift injects heavy emphasis on national security and risk control into a policy framework that previously prioritized fostering the AI industry.

According to a July 15 report by the Mainichi Shimbun, the Japanese government finalized a revised "AI Basic Plan" during a cabinet meeting on July 14. The updated plan designates high-performance AI as both a core technology for driving national power and industrial competitiveness, and a primary threat that could be weaponized for cyberattacks.

"While advanced AI is directly linked to solving social issues and strengthening national power, there are growing concerns over new risks, such as its potential exploitation in cyberattacks," Sanae Takaichi, Minister of State for AI Strategy, stated during an earlier AI Strategy Headquarters meeting on July 10. She emphasized that Japan must secure robust AI development and utilization capabilities within the security and cyber sectors.

The direct catalyst for this policy shift was the release of "Claude Mythos Preview" on April 7 by U.S. AI firm Anthropic. Offered on a limited basis, this model demonstrated the ability to detect previously unknown security vulnerabilities in major operating systems and web browsers, and autonomously write functional exploit codes. Anthropic noted that Mythos represents a significant leap forward from existing models in discovering and exploiting software flaws, urging the industry to mount an urgent, collective defense.

AI finds vulnerabilities and launches attacks

Mythos can analyze massive volumes of source code to detect vulnerabilities without continuous human intervention. Anthropic explained that the model uncovered thousands of security flaws in key software powering internet infrastructure, with many of those vulnerabilities classified as highly severe.

		0
The Prime Minister's Official Residence in Japan. During an AI Strategy Headquarters meeting on July 10, Prime Minister Sanae Takaichi stated, "While advanced AI is directly linked to solving social issues and strengthening national power, there are growing concerns over new risks, such as its potential exploitation in cyberattacks." / Photo by Tokyo Correspondent Choi Young-jae

If utilized for defense, this capability allows for the early detection and patching of security vulnerabilities. However, if exploited by criminal organizations or hostile forces, it could significantly lower the barrier to entry for large-scale cyberattacks. This means that even non-professional hackers could increasingly target financial networks, telecommunication systems, and energy facilities with the assistance of AI.

Previously, the Japanese government favored a "soft law" approach that combined corporate self-regulation with guidelines rather than legal enforcement, aiming to avoid hindering AI innovation. The policy was to address malicious actors through government investigations, guidance, and public disclosures.

However, the emergence of AI with offensive capabilities sooner than anticipated has fueled a growing consensus that relying solely on corporate self-regulation is no longer sufficient. The revised basic plan includes measures to strengthen the cybersecurity of critical infrastructure operators and to enhance the ability of software vendors to quickly detect and respond to vulnerabilities. These same measures were also included in the basic policies for economic and fiscal management formulated by the Japanese government last month.

The Japanese government also plans to proactively leverage high-performance AI for cyber defense. The initiative aims to establish systems to rapidly detect security flaws and analyze signs of impending attacks in sectors directly tied to public life, such as finance, power, and telecommunications.

Japan's AI policy is shifting toward simultaneously strengthening both development and regulation, rather than choosing between the two. While continuing to support the development of domestic AI and semiconductors, the government intends to directly address the cyber and national security risks posed by advanced models. With the pace of AI advancement outpacing policy formulation, Japan's response has entered a race against time.

                                                                                                          Choi Young-jae