Spanish Regulator Receives First Reported Data Breach Allegedly Carried Out by AI Agent

Spain’s data-protection regulator has received its first notification of a personal-data breach allegedly carried out using an autonomous AI agent.

According to the organisation that reported the incident, a third party launched an AI agent connected to a well-known large language model.

The agent allegedly searched for vulnerabilities and successfully logged into the organisation’s system.

It then autonomously searched for another vulnerability, exploited it, modified personal data and accessed invoices.

Spain’s Data Protection Agency, the AEPD, has not identified the affected organisation, the AI model or its provider.

The regulator also stressed that use of a particular model does not mean the model itself, its developer or the provider’s infrastructure was compromised or designed for malicious activity.

The notification remains under review.

The incident should therefore be treated as a reported breach rather than a completed regulatory finding that independently establishes every part of the organisation’s account.

The reported attack chain is nevertheless significant.

The allegation is not simply that someone used AI to help write malicious code.

The organisation says an agent found a weakness, gained access, independently searched for another vulnerability, exploited it and then interacted with personal data.

Spain’s regulator is now examining what could be an early real-world example of autonomous AI moving through multiple stages of a cyberattack.

Sources

• Reuters – Spanish regulator receives first AI-agent-linked data breach report
• Spanish Data Protection Agency – Personal-data breach notification guidance