Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), has received the first breach notification in the country attributed to an autonomous AI agent that chained together multiple attack stages without human direction1,5,6.
Francisco Pérez Bes, deputy director of the AEPD, disclosed the case in a blog post on September 14–15, 20263,8. According to the notification filed by the affected organization, an AI agent built on a widely known large language model scanned publicly accessible files for weaknesses, obtained a working login, then autonomously probed the target application for further vulnerabilities2,11. After finding a flaw, the agent modified personal data and accessed invoices.
What the regulator confirmed
The AEPD described the case as the first in which a third party used an AI agent "as an instrument to successfully chain together different phases of the attack"10. The agency said an agent "can receive a goal, plan intermediate tasks, use tools, execute code, consult sources, interpret results, and modify its actions autonomously, based on what it finds".
Pérez Bes called the incident "a significant sign that attacks supported by artificial intelligence have ceased to be a theoretical risk and are beginning to materialize in incidents that affect real processing of personal data". He added that one notification does not establish a statistical trend7.
The AEPD has not named the language model used, the agent framework, or the affected organization. It stressed that using a particular model does not mean the model itself, or its provider's infrastructure, was compromised, nor that the tool was designed for malicious purposes. The information remains under review; the agency said everything public so far comes from the affected organization's own filing.
Risk-management implications
The AEPD said AI does not create new threat categories but increases the speed, scale, and adaptability of existing attack techniques, reducing the time defenders have to detect and contain intrusions. The agency warned that response procedures designed for manually conducted attacks may be insufficient when an agent can simultaneously analyze different assets, test multiple entry points, and modify its behavior. If an agent gains access to an account, API key, or token with excessive permissions, it can move between services at machine speed before anomalous behavior is identified.
The AEPD urged organizations to incorporate AI-assisted and AI-driven attacks into their risk assessments and to support human oversight with automated detection, containment, and response mechanisms fast enough to match agent-speed intrusions. Spain's National Cryptologic Center (CCN) separately recommended accelerating vulnerability management, strengthening identity protection, controlling the supply chain, and establishing governance for agent use.
Simon Phillips, CTO at CybaVerse, told the Olive Press that people should avoid treating the incident as proof that AI has gone rogue on its own, noting several possible explanations for how the agent obtained access, including a hijacked user session or stolen credentials9.
ANALYSIS The AEPD filing is notable less for the attack technique, which mirrors a standard penetration-testing chain, than for the regulatory surface it creates: a national data-protection authority has formally logged an AI agent as the named vector in a GDPR breach notification, giving the incident a compliance paper trail that lab-disclosed agent escapes have lacked.
Under the General Data Protection Regulation, organizations in the EU must notify their national authority within 72 hours of becoming aware of a personal data breach that risks individuals' rights and freedoms12,14. Pérez Bes said controllers, processors, and data protection officers "must prepare for a scenario in which the speed of attacks will continue to increase".