Spain's data authority receives first breach report tied to an AI agent

Spain's AEPD said on 14 September 2026 it received its first breach notification in which an AI agent using a well-known language model carried out the attack. The agent found vulnerabilities, logged in, modified personal data and accessed invoices; the organisation and model were not named.

• AEPD received its first breach report executed by an AI agent
• The agent found flaws, logged in and modified personal data
• The agency did not name the organisation or the AI model
• AEPD says AI speeds up and scales known threats