Spain's AEPD discloses first data breach allegedly executed end-to-end by an AI agent
evilsocket · x · 2026-09-17
Spain's Data Protection Agency (AEPD) has disclosed the first personal-data breach notification it received involving an attack allegedly executed by an AI agent powered by a well-known LLM — with limited human intervention.
Reported attack sequence:
- Agent successfully logged into the target system
- Autonomously searched the application for vulnerabilities
- Identified and exploited a weakness
- Modified personal data and accessed billing records
The affected organization and the LLM/provider involved were not disclosed. AEPD notes this doesn't imply the model or provider infrastructure was compromised, nor that the tool was designed for malicious use. While one notification isn't a statistical trend, the agency calls it a significant signal that AI-assisted attacks have moved from theoretical risk to real incidents affecting personal-data processing.
More from coding & agent
- Microsoft's MemSteer turns unlabeled user histories into agent memory supervision — MicrosoftResearch · 2026-11-02
- She fired herself from her own Instagram: AI agent runs the account, views up 82.3% — heyshrutimishra · 2026-11-02
- Sourcegraph: AI writes code faster than teams can review it, driving more outages — AI Engineer · 2026-11-02
- Tsinghua & Microsoft's HarnessMM cuts agent token use by up to 87.93% while raising success rate — rohanpaul_ai · 2026-11-02
- GitHub launches Agent HQ: Anthropic, OpenAI, Google coding agents in Copilot — emmanuelvivier · 2026-11-02
- DeepSeek open-sources Super-Agent, a coding agent that reads team chats to minimize human input — emmanuelvivier · 2026-11-02