Spain's data protection authority (AEPD) has reported what appears to be the first known personal data breach carried out by an AI agent, in which an autonomous agent successfully logged in, identified vulnerabilities, modified personal data, and accessed invoices by chaining multiple attack phases together without human direction. The AEPD describes this as a qualitative shift in cyber threats, since AI agents can autonomously plan, adapt, and execute complex attacks at speed. In response, the agency calls for updated risk management practices, faster incident response, stronger credential protection, and AI-assisted defences — while maintaining human oversight throughout.
