Spain reports first end-to-end data breach carried out by an AI agent

Spain's data protection agency (AEPD) reported the country's first breach executed end-to-end by an AI agent: reconnaissance, login, application probing and data modification with no human operator at any step. The same report details a Hacktron attack chain that started with flaws in libheif and ImageMagick and a misconfigured OpenAI SSO, with the exploit built using Claude Opus 5.

• AEPD: the agent completed the whole attack chain without a human operator
• The Hacktron chain began with flaws in libheif and ImageMagick
• The exploit was built with Claude Opus 5
• Attacker LeakySensey compromised 87,000 IPs via PPTP and L2TP, earning $202,000