AI agent orchestrates multistage personal-data breach in Spain

Spain’s data protection authority has disclosed its first notified personal-data breach in which an artificial intelligence agent allegedly carried out several stages of an intrusion, including vulnerability discovery, data modification and access to billing records.

The Agencia Española de Protección de Datos said the incident involved an agent using a known large language model and marked a significant shift in the operational use of AI in cyberattacks. The regulator said the case was still under examination and did not identify the affected organisation, the model provider, the person behind the attack or the scale of the compromised data. The regulator published the notification on September 14 after the organisation reported the incident.

Francisco Pérez Bes, deputy head of the AEPD, said the agent began by scanning generic files and was able to log into the target system. Once inside, it autonomously searched the application for vulnerabilities and exploited a weakness that enabled it to alter personal data and gain access to invoices.

The agency described the AI system as an instrument used to link together different phases of the attack rather than as a model that had independently turned malicious. Its account indicates that a human actor set the operation in motion while the agent performed parts of the reconnaissance, access and exploitation sequence with limited direct intervention.

Pérez Bes said the incident demonstrated that AI-assisted and AI-driven attacks should now be expressly incorporated into risk assessments governing personal-data processing. Existing categories such as malware, phishing or unauthorised access may not adequately capture the speed, adaptability and scale that autonomous systems can bring to an intrusion, he argued.

He also called for organisations to reassess acceptable response times. Procedures designed around attacks conducted manually could prove too slow when an agent can inspect several assets simultaneously, test different entry points and change tactics rapidly after encountering resistance.

Digital identities and credentials were another area highlighted by the regulator. An agent that obtains a valid account, password, key or token with excessive privileges can move across services at machine speed before abnormal behaviour is detected. The AEPD said this increased the importance of tightly limiting permissions and monitoring how credentials are used.

The agency stressed, however, that the basic defensive principles remain familiar. Organisations should understand what personal data they process, minimise unnecessary collection, restrict access, correct known vulnerabilities, supervise suppliers and maintain effective incident-response procedures. Human oversight remains necessary, Pérez Bes said, but must be supported by detection, containment and response mechanisms capable of operating fast enough against automated attacks.

The case comes as security researchers and technology companies document a broader move from conversational use of AI towards autonomous attack orchestration. Google’s Mandiant and Threat Intelligence Group said in a 2026 assessment that adversaries were increasingly using agentic tools for reconnaissance, vulnerability validation and credential harvesting, allowing parts of the attack lifecycle to be executed at machine speed.

Anthropic has separately documented campaigns in which operators used AI frameworks to automate reconnaissance, exploitation and data theft across multiple victims. Its threat-intelligence work said humans generally retained control over target selection and the use of stolen information, while AI systems handled operational steps that previously demanded more time and technical labour.

Those findings broadly align with the Spanish regulator’s assessment that AI does not necessarily create wholly new categories of cyber threat. Instead, it can accelerate familiar techniques, reduce the time between reconnaissance and exploitation, and allow a single operator to manage more targets or tasks than would be practical manually.

The AEPD has not said how the attacker obtained the credentials used in the Spanish case, whether the application flaw had been known before the incident or whether any data was exported beyond the accessed invoices. It has also not disclosed whether affected individuals have been notified.