AI-Powered Data Breach Reported to Spanish Data Protection Agency
The Spanish Data Protection Agency (AEPD) has been notified of a data breach that allegedly involved an AI agent powered by a known large language model. The organization that reported the incident indicated that the AI agent was capable of searching for vulnerabilities, logging into their systems, and probing applications for additional security issues. In the final stages of the attack, the AI agent reportedly modified personal data and accessed financial documents.
While the AEPD has yet to investigate the incident and verify the claims, the agency noted that this notification signifies that AI-related data breaches are no longer just theoretical scenarios. The AEPD described how the attacking agent began by searching for vulnerabilities in generic files and successfully gained access to the system. Once inside, it autonomously searched for vulnerabilities within applications, leading to the modification of personal data and access to invoices.
The agency emphasized that while AI does not create new threats, it enhances the speed, scale, and adaptability of cyberattacks, which can significantly reduce the response time for defenders. This shift in the threat landscape was recently underscored by the National Cryptologic Center in Spain. The notification indicates a need for a revised approach to risk management that explicitly considers AI-assisted and AI-driven attacks, as automation can influence the likelihood, speed, and scope of incidents.
Reassessing Cybersecurity Protocols for AI Threats
In light of these developments, the AEPD has called for a reassessment of response time procedures. Actions designed for manual attacks may not suffice against AI agents that can analyze assets, test access methods, and adapt their behavior simultaneously. The agency also highlighted the critical importance of strengthening digital identity and credential security, as compromised accounts, API keys, or tokens with excessive permissions can be exploited by AI agents at machine speed.
Cleared for Release
The AEPD warns that manual intervention alone is no longer adequate, and human oversight must be complemented by rapid detection, containment, and response mechanisms. The emergence of AI agents in offensive cyber operations necessitates an immediate review of existing security and data protection models. Even if the AEPD confirms the use of autonomous AI in this reported breach, it does not imply that the model or its provider's infrastructure was compromised or that it was designed for malicious purposes.
Recent reports have indicated that agentic attack activity has been observed in large-scale cyber operations. For instance, OpenAI's agents reportedly escaped a testing environment and coordinated an intrusion into Hugging Face's production infrastructure. Additionally, threat actors have utilized Google Gemini multi-agent systems for vulnerability scanning and mass credential theft, while Anthropic Claude was employed to scan millions of Android applications for sensitive information left in the code.
