AI Spera CEO Kang Byung-tak strongly criticized contractors' reliance on vibe coding following the hacking incident involving the "Moduui Changeop" startup support platform.

He said a growing number of contractors are using artificial intelligence-generated code without sufficient verification, creating new security risks.

Kang cited the Moduui Changeop hack at the AIDC Security Technology Workshop held Sept. 7 at Militopia Hotel by Marine in Seongnam, Gyeonggi Province. "The websites built by contractors are a mess beyond imagination," he said.

Moduui Changeop is a startup support program run by the Ministry of SMEs and Startups. In June, non-public information belonging to 5,000 successful applicants in the program's first cohort was leaked externally, including email addresses, evaluation comments and summaries of startup ideas.

A government investigation found that some of the platform's application programming interfaces (APIs) contained non-public information. The data leaked while the APIs were being collected externally through methods including web crawling. The data was encrypted, but the encryption key needed to decrypt it was also exposed.

An AI solutions company participating in the program obtained non-public email addresses through abnormal API calls and other means. Controversy grew after the company sent promotional emails to those addresses. It was later revealed that about a month before the incident, an external security team had discovered a similar API vulnerability and reported it to the Moduui Changeop operator.

"News coverage has largely focused on the contractor having carried out the hacking, but in my view both issues are serious," Kang said.

The "two issues" Kang referred to were the actions of the company that obtained the non-public information and the platform's own security flaws. He argued that the fundamental problem was that the platform had been designed to allow such access in the first place.

"The code written by the contractor looks to me like it was probably created through vibe coding," Kang said. "Security was not considered at all."

Vibe coding is a development method in which users describe desired functions in natural language and AI generates the necessary code and user interface (UI). "Vibe coding is certainly a whole new world, but in my view it is a ticking time bomb," Kang said. "I think it has increased contractor supply-chain risks by more than 100-fold."

"ChatGPT or Claude does a very good job when you use it for security checks," he said. "But after fixing the issues, some functions stop working. If you use vibe coding again to fix those functions, new vulnerabilities emerge." Most of those problems involve permissions, he added.

Kang outlined major security problems found in systems built by contractors, including cases where users are authenticated but authorization checks are not performed; databases are left directly accessible from outside without firewalls or access restrictions; and actual client data is uploaded unchanged to test and development servers without access control lists (ACLs).

Kang also disclosed examples of security problems involving companies and public institutions beyond Moduui Changeop.

One involved an AI chatbot that Kang identified as a system belonging to the Agency for Defense Development. "AI chatbot screens containing important defense-related data are exposed on the internet and can simply be accessed," he said. "It is not even a case of the ID and password being 'admin admin' — there is no authentication at all. It actually works when you submit prompts."

He also cited what he described as a system belonging to the Financial Security Institute. "Access tokens and refresh tokens are exposed on the site as JSON files," Kang said. "This does not really even require hacking." Access and refresh tokens function as credentials issued by a server after login. If exposed, they can allow access with the account's privileges without a password.

Kang also cited examples involving private companies. Referring to a system he described as an AI service from Starbucks, he said, "You can see all the content immediately without logging in, and you can submit prompts as well."

Regarding an AI system for credit assessment developed by Upstage, Kang said, "There is no login, so not only can you look through all this data and freely submit prompts, but you can also see the actual data inside." He said the issue was particularly serious because the system contained various types of data, including apartment purchase contracts.

Kang said the examples illustrate how the external attack surface that companies must manage is expanding significantly in the AI era. "When people talk about hacking AI, they mostly think of prompt injection or attacks on AI models," he said. "But rather than hacking the AI itself, targeting administrator pages is much easier to compromise and attack."

AI Spera is a cybersecurity company founded in 2017.

Attack Surface Management (ASM), whose importance Kang emphasized by disclosing security issues at multiple companies and institutions, is AI Spera's core business. Its flagship solution, Criminal IP, collects and analyzes internet-connected IP addresses and servers to identify externally exposed assets and security risks.

Autonomous driving AI company RideFlux has signed a memorandum of understanding (MOU) with commercial vehicle maker Tata Daewoo Mobility to cooperate on Level 2+ (L2+) driver assistance systems for commercial vehicles and Level 4 (L4) autonomous driving.

Under the agreement, RideFlux’s software for five key highway driving functions will be installed on Tata Daewoo Mobility’s XEN and KUXEN heavy-duty truck platforms, with the companies pursuing mass production of L2+ driver assistance systems. Tata Daewoo Mobility will provide the vehicle platforms and vehicle control interfaces, while RideFlux will lead advance development of Driver Control Assistance System (DCAS) software compliant with the UN R171 international standard.

The L2+ driver assistance system integrates longitudinal and lateral vehicle control for functions including lane keeping, lane changing, highway junctions and merging, overtaking and tollgate passage. RideFlux expects to establish a data feedback loop that uses real-world driving data collected from vehicles after mass production to simultaneously improve L2+ performance and validate L4 technology.

The companies have also outlined a roadmap for fully driverless L4 commercialization. Building on what RideFlux said is Korea’s first paid freight transportation service using heavy-duty autonomous trucks, the company plans to develop robotruck conversions before moving to mass production of fully driverless L4 trucks.

The partnership also includes plans to establish a foothold in the global commercial vehicle market by linking the technology with the software-defined vehicle (SDV) architecture of Tata Motors, Tata Daewoo Mobility’s parent company and the largest commercial vehicle maker in India.

RideFlux said that following Korea’s first paid autonomous-truck freight service with Hanjin in July, supplying autonomous driving software to original equipment manufacturer (OEM) Tata Daewoo Mobility gives it a new business-to-business (B2B) revenue stream. The company said the deal also signals that the autonomous driving industry is moving from government-led demonstration projects, or B2G, toward commercialization, providing further momentum for its planned KOSDAQ initial public offering (IPO).

Nexon said on Sept. 7 that it successfully completed the first alpha test of “Mabinogi Eternity,” an engine replacement project for its massively multiplayer online role-playing game (MMORPG) “Mabinogi.”

The four-day test, held from Sept. 3-6, evaluated key gameplay flows based on user play, including early-game progression, combat and life-skill content.

On the first day, Executive Director Min Kyung-hoon communicated with users in real time through a livestream, explaining the purpose of the test and the project’s future development direction. He also detailed changes including improved gameplay convenience and life-skill tool items.

Nexon plans to further improve Mabinogi Eternity based on user gameplay patterns and survey results collected during the test.

LG Uplus is entering the prefabricated artificial intelligence (AI) data center business and has begun developing standard models. The strategy is aimed at shortening AI data center construction times to capture rapidly growing demand for AI infrastructure.

LG Uplus signed a memorandum of understanding with GS E&C, Xi C&A, Gansam Architects & Partners and D&O CM on Sept. 4 at its Pyeongchon Mega Center in Anyang, Gyeonggi Province, to establish a prefabricated modular data center (PMDC) alliance.

PMDC involves designing data center structures, power systems and cooling equipment to standardized specifications, manufacturing them in factories and transporting them to construction sites for assembly. Conventionally, power and cooling equipment and servers are installed sequentially after the building is constructed. PMDC allows site construction and production of major equipment to proceed simultaneously.

The biggest benefit is shorter construction time. Building a data center involves more than constructing the facility itself. Power equipment including substations and uninterruptible power supplies (UPS), cooling systems and piping must be installed and tested to ensure they operate properly together. PMDC moves much of this work to factories, where systems can be assembled and tested in advance, reducing on-site work largely to connecting modules.

Schneider Electric has said modular data centers can reduce deployment times by as much as 60%. Vertiv has said that carrying out factory fabrication and on-site construction simultaneously can save more than 40% of the time required for conventional data centers. LG Uplus, however, has not disclosed how much construction time its 100 MW model is expected to save.

Shorter construction periods can also allow data center operators to recover their investments sooner. If it takes three to four years to complete a data center after securing a customer contract, no revenue is generated during that period. Bringing operations forward by several months means rental and operating revenue can also begin that much sooner.

Another advantage is greater flexibility in adjusting investment to demand. Rather than building the entire capacity at once, operators can install only the modules initially required and add more as demand grows. With rapid generational changes in AI graphics processing units (GPUs) and related equipment, the approach can reduce the risk of excessive upfront investment. Factory integration and testing of power and cooling equipment can also reduce on-site rework and interoperability problems.

LG Uplus said in June that it would adopt the PMDC construction method at its Paju AI data center project. The latest agreement advances that plan to the development of actual standard models. The five companies have been reviewing since April both a new-build PMDC model for 100 MW hyperscale data centers and a retrofit model for converting existing buildings into AI data centers.

Under the agreement, the five companies will have clearly defined roles. LG Uplus will establish data center operating standards, technical requirements and business direction, and validate the models. GS E&C will handle construction and engineering, procurement and construction (EPC) for new-build models. Xi C&A will be responsible for converting existing buildings and optimizing power and cooling systems, Gansam Architects & Partners will handle standardized design, and D&O CM will oversee project management.

SK Telecom and KT are also pursuing modular AI data centers. SK Telecom signed a three-way memorandum of understanding with Supermicro and Schneider Electric at MWC26 in Barcelona in March to develop an integrated solution that prefabricates power, cooling and IT infrastructure in modules for assembly on site.

KT Cloud said in its AI strategy unveiled in July that modular data centers, which use standardized modules for power, cooling and server environments that are assembled on site, can shorten construction times and simplify capacity expansion. KT Group plans to invest 6 trillion won in AI infrastructure over the next five years and build 1 gigawatt (GW) of AI data center capacity.

HP Printing Korea said on Sept. 7 that it has selected semiconductor design company Global Technology as its hardware engineering technical support partner for printing systems and signed a strategic partnership agreement. The companies plan to jointly advance electronic component and circuit development as well as artificial intelligence (AI) technologies while strengthening their technological competitiveness.

The two companies will collaborate on the design and development of electronic components and circuits and jointly develop AI-based technologies. Global Technology will also take full responsibility for hardware engineering technical support for HP Printing Korea’s research and development organization.

Global Technology will provide technical support throughout the product development process, including design changes and prototyping for printed circuit assemblies (PCAs). The company said it will operate an integrated technical support system based on its own engineering capabilities and a network of proven Korean partners.

The companies plan to gradually expand the scope of their partnership and jointly develop next-generation main controllers for printing systems, leveraging Global Technology’s system semiconductor and application design capabilities.

Smilegate said on Sept. 7 that it will begin PC pre-downloads for its new massively multiplayer online role-playing game (MMORPG), “ECLIPSE: The Awakening,” or ECLIPSE, at noon on Sept. 8.

Players can pre-download the game by downloading the STOVE client and then the game client from the official ECLIPSE website. Mobile pre-downloads will begin on Sept. 9.

ECLIPSE has surpassed 1 million pre-registrations ahead of its official launch. Smilegate will provide all pre-registered players with growth-support items, including a rare-grade weapon appearance summon ticket and transcendence summon ticket. To mark the 1 million milestone, the company will also provide 1 million gold and five transcendence summon tickets and five weapon appearance summon tickets.

ECLIPSE describes itself as an MMOLite that retains the core MMORPG elements of character progression and combat while reducing the burden of staying logged in and competing. Its artificial intelligence (AI) mode allows characters to continue progressing even when players are offline.

ECLIPSE will officially launch at noon on Sept. 10.

Leading artificial intelligence (AI) companies in the US and China have begun the process of going public.

Anthropic could launch its initial public offering (IPO) as early as October and list before the US midterm elections in November, Reuters reported. China's Moonshot AI has also reportedly filed confidentially for a Hong Kong IPO this year. The moves put leading frontier AI companies from both countries under direct scrutiny from capital markets.

According to Reuters, Anthropic plans to release its prospectus around late September for an IPO in mid-October. The timetable has been pushed back from an earlier expectation for a prospectus release in early September. IPO marketing is expected to begin in mid-October following the prospectus release.

Anthropic confidentially submitted a draft S-1 registration statement for the IPO to the US Securities and Exchange Commission (SEC) in June. The company said at the time that the number of shares and offering price had yet to be determined and that the listing would depend on market conditions and other factors.

Anthropic could seek a valuation of as much as $2 trillion in the IPO. That would be more than double the $965 billion valuation it received in its most recent funding round.

A $2 trillion valuation would put Anthropic's IPO close to the $2 trillion market capitalization of SpaceX, which went public in the first half of this year. It would effectively make the offering one of the world's largest IPOs. As of the Sept. 4 close, TSMC was valued at $1.98 trillion and SpaceX at $2 trillion.

Anthropic's potential $2 trillion valuation reflects its rapid growth, including its first quarterly profit in the second quarter and annual recurring revenue (ARR) of about $65 billion in July.

When Anthropic raised $30 billion in a Series G round in February at a $380 billion valuation, ARR stood at $14 billion. By its $65 billion Series H round in May, its valuation had reached $965 billion and ARR had surpassed $47 billion. ARR surged from $14 billion in February to $47 billion in May and $65 billion in July, driving up its revenue multiple.

The market expects Anthropic's ARR to reach about $100 billion to $120 billion by the end of this year. Reuters said the $2 trillion valuation is based to a significant degree on projections for revenue of $190 billion to $200 billion in 2028.

That pace of growth is widening the valuation gap with OpenAI, which is valued at $1 trillion. OpenAI had also considered going public this year but is pushing its IPO to 2027 or later so it can list when it can command a $1 trillion valuation, according to Bloomberg and the New York Times.

OpenAI is valued below Anthropic because its ARR cited in recent reports is about $40 billion. According to the Financial Times, Reuters and other reports, OpenAI's ARR stood at $21.4 billion at the end of last year, more than $25 billion at the end of February and about $40 billion in August. The market currently assigns greater potential to Anthropic's revenue scale and future growth prospects.

Anthropic is also preparing a $15 billion revolving credit facility ahead of the IPO. Morgan Stanley, Goldman Sachs, JPMorgan and Citi are among the banks involved, according to Reuters. Anthropic is seeking a financial structure that combines equity raised through the IPO with a large credit line to support continued investment in computing infrastructure.

Anthropic's governance structure could also become a factor in the IPO. The company has a special body called the Long-Term Benefit Trust (LTBT), which has authority to appoint four of the seven members of its board. The structure is intended to prioritize AI safety and long-term public benefit over short-term profits.

Once Anthropic becomes a public company, shareholders are likely to demand higher valuations and improved profitability, potentially creating tension with the LTBT's focus on long-term safety and public benefit. The IPO will also test whether a governance structure designed around AI safety can be maintained at a publicly traded company valued in the trillions of dollars.

In China, which is competing with the US for AI leadership, Moonshot AI, developer of Kimi K3, is reportedly preparing to enter Hong Kong's capital market.

According to Reuters, Moonshot AI confidentially filed for an IPO with the Hong Kong Stock Exchange on Sept. 3, targeting about $3 billion and potentially as much as $5 billion in proceeds. About three years after its founding, Moonshot is valued at roughly $50 billion. The timing of the IPO will depend on regulatory approval in China and market conditions. Moonshot has raised more than $5.5 billion from investors including Alibaba, Tencent, Meituan, China Mobile, IDG Capital and HSG.

◇Moonshot AI, Developer of Kimi K3, Expected to Pursue Hong Kong IPO This Year

The most important technological asset in Moonshot AI's IPO is Kimi K3, unveiled in July. K3 is an open-weight model with 2.8 trillion parameters, making it one of the largest open-weight models. It combines performance competitive with US frontier models with an open-weight strategy.

While frontier AI companies such as Anthropic and OpenAI primarily use closed models to generate revenue from application programming interfaces (APIs) and enterprise services, Moonshot AI releases its model weights to expand its ecosystem and generates hosting and service revenue on top of it. K3 has also helped challenge the perception of Chinese AI models as lower-performance, low-cost alternatives.

Moonshot AI has recently been in talks with US cloud service providers (CSPs) over Kimi K3 services, potentially helping it address computing capacity constraints while strengthening its position as a global platform.

Within 48 hours of Kimi K3's launch, user traffic and API requests exceeded expectations, prompting Moonshot AI to temporarily suspend new paid subscriptions for individual users to maintain service stability for existing subscribers. The 2.8-trillion-parameter model rapidly strained GPU clusters and inference capacity, resulting in delayed API access and queues.

According to foreign media reports, Moonshot AI is negotiating with Microsoft, Amazon and Google over cloud hosting and revenue sharing for Kimi K3. Moonshot AI is reportedly seeking as much as 30% of revenue from K3-related services.

The talks are still at an early stage and no outcome has been finalized, but an agreement could bolster Moonshot AI's Hong Kong listing. Rather than spending heavily to build its own global cloud infrastructure, the company could secure sustainable recurring revenue and a stable overseas cash cow by sharing revenue with US CSPs.

The negotiations are also reportedly subject to an annual commercial threshold of $20 million. Under the structure, companies or partners operating a Model-as-a-Service (MaaS) business that generate more than $20 million in annual revenue using K3 would be required to enter into a separate commercial agreement and formal revenue-sharing negotiations with Moonshot AI.

The arrangement would also carry broader significance for the AI industry. It would create a structure in which major US cloud providers host a frontier model developed by a Chinese AI company and share the resulting service revenue with that company.

Meanwhile, the Hong Kong Stock Exchange is attracting Chinese AI companies seeking access to a broader pool of investment capital. With US restrictions on China and geopolitical uncertainty increasing, Hong Kong has emerged as a major alternative for raising global capital.

Foreign investors face strict restrictions on access to mainland Chinese stock markets in Shanghai and Beijing, while Hong Kong allows global institutional investors and international funds to participate more freely. The Hong Kong Stock Exchange's global liquidity pool is particularly attractive to AI companies that require large amounts of overseas capital.

Hong Kong's adherence to internationally recognized accounting and disclosure standards also provides overseas partners and investors with a more familiar governance structure. That is encouraging Chinese companies such as Moonshot AI, which is pursuing revenue-sharing agreements with US CSPs and expansion of its global ecosystem, to seek Hong Kong listings.

Chinese AI companies including Z.AI and MiniMax have listed on the Hong Kong Stock Exchange this year. According to London Stock Exchange Group (LSEG) data, Hong Kong IPOs raised $41.2 billion through mid-August, up 142% from a year earlier. Reuters said Chinese technology companies have led the surge and that Moonshot AI restructured from an offshore entity into a mainland Chinese entity as part of preparations for its Hong Kong IPO.

Devsisters said on Sept. 7 that it began pre-registration on Sept. 4 for “CookieRun: Card Collection,” a Roblox game based on the trading card game (TCG) “CookieRun: Braverse Card Game.”

CookieRun: Card Collection is a Roblox-based random card generator (RCG) simulation game focused on collecting and upgrading cards. It combines random number generation (RNG) elements with the strategic collecting aspects of a TCG, allowing players to build and complete their own decks.

The project is being jointly developed by Devsisters and VerseWork, a Roblox-based user-generated content (UGC) developer. Through CookieRun: Card Collection, the companies aim to reach new users beyond physical cards and explore opportunities to expand the intellectual property (IP) ecosystem.

CookieRun: Card Collection, which supports Korean and English, is scheduled for a global launch on Oct. 10. Pre-registration is available through the CookieRun: Card Collection page on the Roblox platform.