- Spain’s data protection agency (AEPD) reported its first breach carried out by an autonomous AI agent
- Agent chained multiple attack stages: accessed public files, scanned systems, exploited a flaw, and modified data
- AEPD urged businesses to factor AI‑driven attacks into risk assessments, stressing faster response and stronger identity controls
A Spanish company was apparently hit with a data breach conducted by an autonomous AI agent.
Earlier this week Francisco Pérez Bes, president and deputy of the Spanish data protection agency (AEPD) published a new article on the agency’s blog, saying it “received the first notification of a personal data breach in which the incident was reportedly carried out using an artificial intelligence agent powered by a well-known large language model.”
As per Pérez Bes, the agent first used the target’s “publicly accessible files”, through which it was able to log into its system. From the inside, the agent then started scanning for vulnerabilities and after finding one, used it to modify personal data and gain access to invoices.
A call to action
The author stresses that there is very little known about this incident and that a thorough investigation is currently ongoing. He pointed out that the attack doesn’t imply the AI model or the provider’s infrastructure were compromised or malicious by design, but said that the attack was “significant from a data protection perspective,” since the AI agent was used to chain together multiple stages of the attack.
For Pérez, the attack is a call to action – businesses need to rethink how they assess and manage security risks. He claims businesses need to “explicitly account for AI-assisted and AI-driven attacks when assessing the risks associated with personal-data processing,” and need to reassess their response times.
“Procedures designed around manually executed attacks may not be sufficient when an AI agent can analyze multiple assets at once, test different avenues of attack, and rapidly adapt its behavior based on what it finds.”
He also stressed the “growing importance of digital identities and credentials,” since an AI agent with an account or an API key “can operate at machine speed and move across different services before an organization has time to detect the anomalous activity.”
Via The Register
