South Korea's Financial Services Commission held an emergency meeting this week after a series of cyberattacks on financial institutions in the country. BleepingComputer's headline says the attacks are suspected to be AI-powered.

The reporting names a regulator, a meeting, a run of incidents and a suspicion. It names no vulnerability, no malware family, no stolen-credential path and no count of affected customers. (An emergency meeting is the one control a regulator can deploy before the forensics are done, which may be why it arrived first.)

"AI-powered" describes a mood. A phishing kit that drafts fluent Korean and a model that finds a flaw in an exposed service are different intrusions, with different controls under them, and the word covers both.

Consider the risk officer at one of the affected banks, or at a bank that expects to be asked. The commission has convened. The incident log in front of that officer records a login, a mailbox rule, a service account, an exposed port. It has no field for a suspicion.

Before the commission publishes anything, each bank will have put its own account of the entry point in writing. Those accounts will be compared with each other, and with whatever the commission eventually names.