Spain's data regulator received its first breach report blaming an autonomous AI agent

Undisclosed (Spain), disclosed 15 Sep 2026. AI-run attack Exposed and destroyed High

An organization told Spain's data protection agency that an attacker's AI agent, built on a known language model, logged into its systems, hunted for flaws on its own, altered users' personal data and accessed invoices. The regulator stressed the account is unverified and did not name the organization or the model.

Disclosed

15 Sep 2026

Organization

Undisclosed (Spain)

Vendor

Unknown

Kind of AI

Autonomous agent

AI's role

Attacker used AI

How it happened

AI-run attack: Autonomous intrusion

Harm

Exposed and destroyed

Data involved

Personal data, Financial

Reach

One organization

Severity

High

Model at fault

No

Status

Reported

Country

ES

Sources

1. https://www.securityweek.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/
2. https://www.bleepingcomputer.com/news/security/spains-data-agency-gets-first-report-of-ai-powered-data-breach/