Threat · curated 18 Sep 2026
AI Agent Breaches Spanish Organization, Modifies Personal Data
First reported darkreading.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
The AEPD case marks a documented real-world instance of an AI agent autonomously finding and exploiting weaknesses to breach corporate data, signaling that agentic attacks are moving from theory into reported incidents defenders must prepare for.
Spain's Data Protection Agency (AEPD) disclosed what it describes as the first reported personal-data breach caused by an attack executed via an AI agent, in which an unidentified attacker used a well-known language model to discover and exploit loose credentials and an enterprise application vulnerability at an unnamed Spanish organization. The agentic system, operating with human oversight, modified personal data records and accessed corporate invoices.