First Reported AI Agent-Linked Data Breach in Spain

• •First known data breach executed by an AI agent reported in Spain.
• •An AI agent used a large language model to autonomously identify vulnerabilities and modify data.
• •The breach indicates a shift towards autonomous systems playing a direct role in cyberattacks.

The Spanish Data Protection Agency (AEPD) announced the first reported data breach allegedly executed by an AI agent. The incident involved an AI agent utilizing a large language model to identify system vulnerabilities, gain unauthorized access, and modify personal data, including invoices. The breach was reported by the affected organization and is currently under investigation. AEPD clarified that the AI model used did not imply that the model or its provider's infrastructure was compromised. This case highlights the increasing role of autonomous systems in cyberattacks, as it involved multiple stages of the attack with limited human intervention. The agency emphasized that while AI does not create new threats, it enhances the speed and adaptability of existing malicious techniques. The AEPD is reviewing the incident and has not disclosed the identity of the targeted organization or the specific AI model involved.