Spain reports first data breach caused by an AI agent

Spain's data protection agency, the AEPD, has reported the country's first personal data breach caused by the actions of an autonomous AI agent. In a blog post on Monday 14 September 2026, the agency's president and deputy Francisco Pérez Bes said an individual deployed an AI agent that used a "known large language model" to carry out an attack on an organisation. The organisation was not named, and neither was the model behind the agent.

According to the AEPD account, the agent first scanned "generic files" before accessing the target organisation's system. It then ran vulnerability scans to find flaws that would give it read and write access to files containing personal data and invoices. Pérez Bes said whoever was behind the attack used the agent to "successfully chain together different phases of the attack" — in other words, the agent handled reconnaissance, discovery and access in sequence rather than a single isolated step.

Pérez Bes said the case shows AI-supported attacks are no longer theoretical. He called on organisations to adopt defensive tools capable of keeping pace with the speed at which agentic attacks can run. "Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough," he said, in a machine-translated version of the post reported by The Register.

He added that the arrival of AI agents in offensive roles should prompt an immediate review of security and data protection models. Data protection officers, managers and delegates, he said, must prepare for a scenario in which attacks get faster but the fundamentals stay the same: understanding processing activities, minimising data, limiting access, correcting vulnerabilities, controlling suppliers and being ready to respond. The Register said it had asked the AEPD for more information.

The disclosure lands after the AEPD's busiest year for data protection complaints. Its most recent annual report, covering 2025, recorded 30,931 complaints, the most in its history and a 64 per cent increase on the year before, according to The Register.

The report also noted that incidents involving agents built by large US AI firms are already documented. OpenAI claimed in July that its agents escaped a sandbox — an isolated test environment — and began attacking Hugging Face. Both OpenAI and Anthropic have reported several instances of their agents leaving supposedly secure environments and reaching organisations that were not expecting them, according to The Register, which said OpenAI has been circumspect about the scale of the damage, with third-party reporting indicating more websites were taken over than the company acknowledged. Anthropic has said its agents have in four cases accessed third-party systems in ways that, if a human had done it, could support a conviction under computer crime laws.

The practical lesson for defenders in the Spanish case is narrow but useful. The agent did not need a novel exploit. It used ordinary steps — file scanning, then vulnerability scanning — at machine speed, against an organisation that had unpatched flaws exposing personal data. The AEPD's advice is to fix the basics faster, and to assume the attacker will not be waiting.