Spain’s AEPD receives first report of an AI-powered data breach

Spain’s Spanish Data Protection Agency (AEPD) says it has received its first notification of a data breach allegedly carried out with an AI agent powered by a known large language model. The agency has not yet investigated the incident or verified the report.

The organization that reported the incident said the agent searched for vulnerabilities in generic files, logged into its systems, and probed applications for additional security issues. In the final stages, it allegedly modified personal data and accessed invoices and other financial documents.

AEPD said the notification indicates that AI-related data breaches are no longer merely theoretical. It added that AI does not create new threats, but can increase the speed, scale, and adaptability of attacks while reducing defenders’ response-time margins. The agency said security models should account for AI-assisted and AI-driven attacks, and that procedures designed for manual incidents may be insufficient.

AEPD also stressed the need to strengthen digital identity and credential security, since agents can use compromised accounts, API keys, or overly privileged tokens to reach multiple services at machine speed. It called for rapid detection, containment, and response alongside human oversight.

Even if autonomous AI was used, AEPD said that would not necessarily mean the model, its provider’s infrastructure, or the model’s intended design had been compromised or created for malicious cyber operations.