What the regulator says happened
Spain’s data protection authority, the AEPD, says it has received its first notification of a personal data breach in which the attack was carried out by an AI agent. In a blog post dated 14 September, the agency said the agent ran on a well-known language model, which it did not name. It did not identify the organisation that reported the breach either.
According to the AEPD, the agent first searched generic files for weaknesses and then logged in to the system successfully. Once inside, it looked for vulnerabilities in the application on its own, and after finding them it was able to modify personal data and access invoices.
The agency’s reading, as SecurityWeek reports, is that a third party used the agent as a tool to chain the different stages of the attack together.
Why the AEPD is flagging a single case
Organisations in the EU must report personal data breaches to their supervisory authority, which is how this one reached the AEPD. The agency is careful about what one report can show. It says the details so far come from the affected organisation’s own notification and still have to be analysed, and that a single case does not establish a trend, Infobae reports.
It nevertheless treats the case as a sign that AI-assisted attacks are no longer theoretical. The blog describes why agents change the picture: an agent can receive a goal, plan intermediate tasks, use tools, run code, read sources, interpret the results and adjust what it does, all without a person steering each step. That, the AEPD argues, changes the likelihood, speed and reach of an incident.
What it asks organisations to do
The AEPD says risk analyses should now explicitly include attacks that are assisted or executed by AI. It also asks organisations to:
- review response procedures that assume an attacker moves at human speed;
- put digital identity and credential security first;
- add automated detection, containment and response, with human oversight;
- keep to the basics: know what data they process, collect less of it, limit access, fix known flaws and supervise suppliers.
What is still unknown
The post leaves open how the attacker obtained working credentials, which model was used and how much data was affected. Simon Phillips, chief technology officer at CyberVerse, told SecurityWeek the case could involve a deliberate bypass of a model’s safeguards, an agent escaping a test environment, or unauthorised use of a custom model built on a popular one.
The AEPD has not said whether it will open an investigation into the organisation. Its analysis of the notification is the next thing to watch.
