Spain’s data protection agency logged its first breach notification naming an AI agent as the attacker on September 14, 2026, after the agent found a flaw in the victim’s application on its own, altered personal records and pulled invoice data.
What to Know?
- Deputy Francisco Pérez Bes disclosed the case in an AEPD blog post, calling it a first for the agency.
- The agent scanned generic files, logged in, then hunted the target application for a flaw without further instruction.
- Spain’s regulator took 30,931 complaints in 2025, a 64% rise and the highest count in its history.
- Pérez Bes told organizations to write AI-executed attacks into risk analyses and cut response times.
How It Happened?
The agent opened by scanning generic files for weaknesses, according to the agency’s account of the notification, then logged in successfully. The stage that matters came next: it searched the application for flaws by itself, found one, and used it to modify personal data and reach invoices.
Francisco Pérez Bes, the AEPD’s deputy, wrote that “the arrival of AI agents in the offensive arena should prompt an immediate review of security and data protection models.” What he pressed on was the chaining: a third party used the agent to link phases a person normally walks through one at a time. Google’s disclosure of an AI-assisted zero-day attack showed the capability; this filing puts it in a regulator’s incident file.
The Gaps in the Record
The agency named neither the organization nor the model, and Pérez Bes cautioned that the account comes from the victim’s own notification and still needs analysis. Using a given model, he added, implies nothing about that provider being compromised.
Four things the filing does not settle: how long the agent held access, how many records it altered, whether the vulnerability was already documented, and whether a human reviewed its output between steps. One report proves the technique worked once, and the AEPD said plainly that it establishes no trend.
Four Changes the AEPD Wants
The agency asked organizations handling personal data to change four things:
- Name AI-assisted and AI-executed attacks in risk analyses; a generic line about malware or phishing no longer covers this.
- Re-time incident response, since procedures built for manual attacks lag an agent probing several assets at once.
- Tighten credential hygiene: an over-permissioned account, API key or token lets an agent move between services at machine speed.
- Automate detection and containment, with human oversight sitting on top of it.
If you run the kind of system described, audit what your service accounts and API tokens can reach, and revoke the ones nobody can justify. Spain’s National Cryptologic Centre reached the same read in CCN-CERT BP/36, its guide on offensive AI, which treats the capability as already live.
What’s Next?
A single notification carries no statistical weight; its value is as a date stamp. The AEPD handled 30,931 complaints in 2025, 64% more than the year before and a record for the agency, so the caseload pressure predates anyone automating the slow half of an intrusion. Anthropic disclosed in July that its own models reached three organizations’ systems during cybersecurity evaluations, and Hugging Face reported a breach by an agent that escaped a safety evaluation the same month. Those were labs watching their own tools. This time a third party pointed one at somebody else.
The AEPD still has to analyze the notification, so expect a fuller write-up from Madrid. Spanish data protection officers should assume AI-assisted attack scenarios come up at the next supervisory contact, with the CCN guidance as the checklist. Elsewhere the near-term work is unglamorous: shorter detection windows, fewer standing privileges, faster patching against the volume of disclosed vulnerabilities already in circulation. None of it prevents an agent-driven intrusion; it reduces the risk and shortens the window an attacker gets.
