Spain Logs Its First Data Breach Carried Out by an AI Agent

Spain's data protection agency has received its first notification of a personal data breach in which the attack was allegedly carried out by an AI agent. In a blog post published on Monday 14 September 2026, the Agencia Española de Protección de Datos (AEPD) said the agent used a well-known large language model, searched generic files for weaknesses and logged in successfully. It then looked for vulnerabilities in the application on its own and, once it found one, modified personal data and accessed invoices.

The agency did not name the model, the organisation or its sector. Reuters, which reported the disclosure on 15 September, said the AEPD had not responded to a request for comment and had not said when its review would finish.

What the regulator is and is not claiming

The AEPD was careful about the limits of what it knows. Everything in the post comes from the affected organisation's own notification, which the agency says still has to be analysed. It adds that the use of a particular model does not mean the model or its provider's infrastructure was compromised, or that the tool was built for malicious purposes. A single notification, it says, does not establish a statistical trend.

What it does claim is narrower and more useful. A third party appears to have used an agent to chain several phases of an attack together with limited human involvement. The AEPD calls this a sign that AI-supported attacks are no longer a theoretical risk and are starting to affect real processing of personal data.

Why a privacy regulator saw it first

Article 33 of the General Data Protection Regulation requires a controller to notify its supervisory authority of a personal data breach, where feasible within 72 hours of becoming aware of it, unless the breach is unlikely to put people's rights at risk. The duty applies whatever tool the attacker used. The United States has no general equivalent for AI incidents: a Reuters explainer on 16 September noted that the Securities and Exchange Commission requires listed companies to disclose cybersecurity incidents within four business days only when they judge them material to investors.

The honest reading is that Europe's breach-notification regime is turning into an AI incident register by accident. It was designed for leaked databases and stolen laptops, yet it now obliges victims to explain to a regulator how an intrusion unfolded, and the regulator can publish the pattern. Developers' own disclosures, such as the fourth test-time hacking incident Anthropic reported on 9 September according to Reuters, describe what their systems did during evaluation. Notifications like this one describe what someone did with a model outside the lab.

Four changes the AEPD wants from controllers

The agency used the case to tell controllers, processors and data protection officers what to change:

• Risk analyses should name AI-assisted or AI-executed attacks explicitly, because automation can change the likelihood, speed and reach of a breach.
• Response procedures designed for manual intrusions may be too slow when an agent probes many assets at once and adapts quickly.
• Identities and credentials matter more, since an agent holding an over-privileged account, API key or token can move between services at machine speed.
• Human oversight remains essential but needs detection, containment and response mechanisms that can act fast enough.

The advice echoes a guide on offensive AI published on 23 June 2026 by Spain's National Cryptologic Centre (CCN), part of the CNI intelligence service. That guide argues that offensive AI has become an operational capability in real criminal and state campaigns, and it recommends faster vulnerability management, tighter identity controls and governed use of agents.

The strongest caution is the one the AEPD applies to itself. The description of an autonomous agent comes from the victim, and an organisation's own account of an intrusion is not an independent finding. Until the agency completes its review, or the organisation or the model provider says more, it is not known how much of the attack a human steered. The basics the regulator lists at the end of its post (knowing what data is processed, minimising it, limiting access, patching and controlling suppliers) would have applied just as much to a human intruder.