Autonomous AI agent reportedly breached Spanish company

TechRadar reports that Spain’s data protection agency has disclosed what it described as its first notification of a personal-data breach reportedly carried out by an autonomous artificial intelligence agent powered by a well-known large language model.

According to Francisco Pérez Bes, president and deputy of the Spanish Data Protection Agency (AEPD), the agent first used the target’s publicly accessible files to log into its system. Once inside, it scanned for vulnerabilities. After finding one, it reportedly used the weakness to modify personal data and gain access to invoices.

Few details about the incident are known, and a thorough investigation is ongoing. Pérez Bes said the incident does not imply that the AI model or the provider’s infrastructure was compromised or malicious by design. However, he called it significant from a data-protection perspective because the agent chained together multiple stages of an attack.

Pérez Bes also said organizations should account for AI-assisted and AI-driven attacks when assessing risks associated with personal-data processing and should reassess their response times. He highlighted digital identities and credentials, noting that an agent with an account or API key can operate at machine speed, analyze multiple assets, test different attack paths, and adapt quickly before anomalous activity is detected.