Summary
- Spain’s AEPD has received its first personal-data breach notification in which an AI agent is reported to have executed several stages of an attack.
- The affected organisation reported a valid login, autonomous vulnerability discovery, modification of personal data, and access to invoices.
- The account remains under regulatory review and does not establish a wider trend in autonomous cyberattacks.
Spain’s data protection authority has received its first notification of a personal-data breach in which an artificial intelligence agent is reported to have executed several stages of a cyberattack, moving from authenticated access to vulnerability discovery and the modification of personal information.
The Agencia Española de Protección de Datos (AEPD) disclosed the case on 14 September, based on information submitted by the affected organisation. The regulator said the agent used a known large language model, searched generic files for vulnerabilities, completed a valid login, and then continued looking autonomously for weaknesses in the application.
According to the notification, exploiting one of those weaknesses allowed personal data to be modified and invoices to be accessed. The organisation, model, provider, and date of the intrusion have not been publicly identified.
The AEPD has stressed that the information remains under analysis. The use of a particular AI model does not mean that the model itself or its provider’s infrastructure was compromised, nor does it establish that the technology was developed for malicious purposes.
That distinction also limits how broadly the incident can be interpreted. This is the first notification of its kind received by the Spanish regulator, rather than evidence that autonomous AI attacks have become widespread.
The reported sequence nevertheless differs from more familiar uses of generative AI in cybercrime. Language models have already been used to draft phishing material, generate code, translate messages, and accelerate reconnaissance. An AI agent can go further by pursuing an objective across several steps, evaluating results, using tools, and adapting its next action without requiring a human operator to direct every move.
In the Spanish case, the third party is alleged to have used an agent as an instrument to connect several stages of an attack. The significance lies less in an entirely new class of vulnerability than in the speed with which established attack techniques can potentially be combined.
The reported valid login also keeps identity at the centre of the incident. Autonomous tooling does not remove the importance of credentials, authentication, access controls, exposed applications, and software vulnerabilities. It can instead increase the speed at which weaknesses in those areas are tested and combined.
That creates pressure on incident handling. Under the General Data Protection Regulation, organisations must assess personal-data breaches quickly and notify regulators where the relevant threshold is met. Those regulatory timescales do not change simply because an attacker can operate more quickly.
The same issue applies internally. Detection, triage, containment, and access revocation processes built around prolonged human-led intrusion activity may face a narrower window if reconnaissance and exploitation can be chained automatically.
European organisations are also deploying AI agents for software development, IT operations, data processing, and security work. That creates a related governance problem inside the enterprise: legitimate agents may themselves hold credentials, call APIs, and access sensitive systems. Their permissions and actions therefore become part of identity and access governance rather than a separate AI-only concern.
The AEPD case remains an early and still unverified account supplied by the affected organisation. It does, however, provide a concrete example of an AI agent allegedly being used to connect multiple stages of a personal-data breach — a development regulators and incident-response teams will now be watching closely.
