Spain’s data protection authority (AEPD) reports its first personal data breach in which an autonomous AI agent is blamed for carrying out an intrusion. The agency says the incident involves the agent logging into a company network, performing actions that lead to alteration of personal records, and then pulling invoice data.
The AEPD emphasizes that its account is based on the breach notification submitted by the affected organization and that further analysis is required before final conclusions. Across outlets, the breach is described as multi-stage, with early activity including vulnerability scanning or similar reconnaissance before the agent gains access to files and data. TechRadar and other coverage also note that the agent is powered by a well-known large language model, while Help Net Security and Infosecurity Magazine highlight the sequence of actions attributed to the agent.
While all reports reference the AEPD disclosure, they differ mainly in emphasis: some focus on the agent’s autonomous, self-directed behavior; others underline the security steps taken before access. The AEPD also uses the case to call for an immediate review of data protection and security models as AI agents are used more widely in offensive activity.
