AI agent orchestrates multistage personal-data breach in Spain

Spain's data protection authority has revealed its first recorded personal-data breach involving artificial intelligence. The Agencia Española de Protección de Datos reported the incident on September 14, noting that an AI agent used a known large language model to conduct several stages of an intrusion. These stages included vulnerability discovery, data modification, and access to billing records.

The regulator has not disclosed the affected organization, the model provider, the perpetrator, or the scale of compromised data. Francisco Pérez Bes, deputy head of the AEPD, explained that the AI agent initially scanned generic files to gain access to the target system. Once inside, it autonomously searched for vulnerabilities and exploited a weakness, leading to the alteration of personal data and access to invoices.

Pérez Bes emphasized that the AI system acted as an instrument to coordinate different phases of the attack rather than a malicious model that turned independent. He argued that AI-assisted and AI-driven attacks should be incorporated into risk assessments for personal-data processing, as these attacks can move faster, adapt more readily, and impact a larger scale compared to traditional methods like malware, phishing, or unauthorized access.

The regulator also highlighted the increased importance of limiting digital identities and credentials, as an agent with excessive privileges can rapidly traverse services before abnormal behavior is detected. Pérez Bes stressed that while traditional defensive measures remain crucial, organizations must reassess response times to effectively combat automated attacks.