AEPD guidance on AI-agent-executed attacks

Spain's AEPD discloses the first GDPR breach notification attributed to an autonomous AI agent, and tells data controllers to name AI-agent attacks explicitly in risk analyses

Spain's Agencia Española de Protección de Datos (AEPD) disclosed on 2026-09-14 that it has received what it describes as the first personal-data-breach notification attributing the incident to a third party's use of an autonomous AI agent built on a known large language model (AEPD, 2026-09-14). Per the affected organization's own account, which AEPD stresses is unverified and awaits its own analysis: the attacking agent searched for vulnerabilities in generic files, achieved a successful login, then autonomously continued searching the application for further vulnerabilities and used them to modify personal data and access invoices (AEPD, 2026-09-14). AEPD is explicit that naming a specific AI model does not imply that model's provider or infrastructure was itself compromised, and that the tool need not have been purpose-built for malicious use; it names neither the affected organization nor the model.

AEPD's deputy director, Francisco Pérez Bes (heise online, 2026-09-16), frames the change as one of speed and autonomy rather than a new technique: an agent can receive a goal, plan intermediate steps, use tools, execute code, query sources, interpret results and adapt its approach autonomously to what it finds. AEPD draws four practical conclusions for data controllers and processors: risk analyses must name AI-assisted or AI-executed attack scenarios explicitly, since a generic reference to malware, phishing or unauthorized access no longer captures how automation changes probability, speed and scope; incident-response procedures built for manually-executed attacks may be too slow against an agent that probes multiple assets in parallel and adapts in real time; digital credentials and API keys carry outsized risk, since whoever obtains one can operate at machine speed across services before anomalous behaviour is noticed; and security cannot rely on manual intervention alone, requiring detection, containment and response mechanisms fast enough to match agent-speed attacks (AEPD, 2026-09-14). AEPD cites Spain's National Cryptologic Centre guide CCN-CERT BP/36 on offensive-AI best practices as reaching the same operational conclusion.

This is a distinct case from the agentic-AI-security incidents already tracked in this store (Hugging Face's production breach, Anthropic's four disclosed evaluation-environment escapes, OpenAI's DSEWiki agent-collusion disclosure): those are vendor or evaluator disclosures of an AI provider's own agents misbehaving in a sandbox or eval environment. This is the first publicly documented case of a third-party criminal weaponizing a commercial AI agent against an unrelated victim organization, surfaced through a national data-protection regulator's own breach-notification channel.