First autonomous AI agent cyberattack in Spain: what the AEPD reported and what changes for your company

On 14 September 2026 the Spanish Data Protection Agency (AEPD) published that it had received the first personal data breach notification in which the attack was planned, executed and adapted by an artificial intelligence agent with no direct human intervention at each decision. The agent searched for vulnerabilities, logged in with valid credentials, kept looking for flaws inside the application, modified personal data and accessed invoices. This is not a lab demonstration or a trend report: it is a real breach, notified under the GDPR by a Spanish organisation.

This article summarises what the AEPD has made public, what is still unknown, why the case matters more for its speed than for its technique, and what must change in a company's risk analysis and response from now on.

What the AEPD reported

According to the post published by the AEPD on 14 September, signed by Francisco Pérez Bes, the sequence notified by the affected organisation was as follows:

1. Reconnaissance. The agent started searching for vulnerabilities in generic system files.
2. Access. It completed a successful login with valid credentials. The Agency does not detail where those credentials came from.
3. Autonomous exploration. Once inside, it kept searching on its own for vulnerabilities in the application.
4. Impact. It exploited what it found to modify users' personal data and access invoices.

The AEPD describes it as the first time it receives a notification in which an AI agent "planned, executed and adapted its attack autonomously, without needing direct human intervention at each decision". The agent used a well-known language model, whose name the Agency does not disclose.

What is unknown, and what the AEPD makes clear

Precision matters here, because the story has circulated with more drama than the source allows:

• The affected organisation and its sector are not known. The AEPD does not publish them.
• Neither the model nor who launched the agent is known. There is no attribution.
• The information comes from the organisation's own notification and, in the Agency's words, must undergo the corresponding analysis.
• The model provider's infrastructure was not necessarily compromised. According to the AEPD, the tool was not designed for malicious activity. In other words, someone used a general-purpose agent to attack, not a "hacked" model.

The AEPD's key sentence is this: AI does not create conceptually new threats, but it increases the speed, scale and adaptability of already known malicious techniques, and reduces the time available to detect and contain them.

Why it matters: not the technique, the time

Nothing the agent did is new. Looking for exposed files, logging in with valid credentials, enumerating the application from the inside and abusing a weak access control to touch other users' data is the textbook script of a web intrusion. What changes are three things:

• The whole chain is executed by a single piece of software without pauses. Between reconnaissance and data modification there is no human making decisions, and therefore none of the hours or days a detection team uses to react.
• It adapts. When one path fails, it tries another. A traditional scanner stops; an agent retries with a new hypothesis.
• It scales at no marginal cost. The same agent can be launched against hundreds of targets with the same quality of execution.

For a mid-sized company this means that the mean time to detect and contain it had sized for a human attacker no longer works as a reference.

What we see in our engagements

In our red team exercises of 2025 and 2026, the initial access vector that has worked best for us has been session theft through adversary-in-the-middle phishing and leaked or reused credentials. That is exactly the second step of the sequence notified to the AEPD: the agent did not break anything to get in, it logged in. And once inside, the finding we report most in web applications is broken access control: direct object references and escalation between roles that allow reading or modifying another user's data by changing an identifier. It is the kind of flaw an agent finds by systematic enumeration in minutes.

As for the controls that have stopped us during those exercises: almost none. Reaching domain admin is still the norm. An autonomous agent does not need to be better than a human operator; it only needs not to get tired.

What the AEPD recommends

The Agency's recommendations to data controllers are four, and all of them are operational:

1. Explicitly include AI-assisted or AI-executed attacks in the risk analysis of personal data processing. Not as a footnote, but as a threat category with its own likelihood and impact.
2. Review incident response times, because traditional risk analyses are sized for the speed of a human attacker.
3. Strengthen identity and credential management. The entry point was a valid login.
4. Implement automated detection and response mechanisms. Human oversight remains essential, but it must rely on fast detection, containment and response.

What must change in your company: six concrete actions

1. Add "attack executed by an AI agent" to the risk register of the processing activity, the ISMS or the NIS2 analysis. With likelihood "high" as of today: the case already exists.
2. Phishing-resistant authentication on everything exposed to the internet. FIDO2-based MFA or passkeys on administration access, VPN, email and applications holding personal data. SMS or app codes do not stop an AiTM proxy.
3. Access control audit of the applications that process personal data. Authorisation tests per role and per object, not just a scanner. It is the flaw the agent exploited to modify data.
4. Detection that does not depend on a person watching a console. Automated rules in the EDR and the SIEM for anomalous logins, fast resource enumeration and bulk record modifications, with automated response (session blocking, host isolation).
5. A 72-hour notification drill. The GDPR requires notifying the AEPD within 72 hours of becoming aware. If your procedure exists on paper but has never been executed, the clock of an autonomous agent will test it.
6. An offensive exercise that replicates the scenario. A web application pentest focused on authorisation, or a red team exercise with credential-based initial access, measures in hours what an agent would take and which controls would see it.

Frequently asked questions

Did the AI model decide to attack?

Nothing published by the AEPD indicates that. An AI agent executes objectives set by a person; what is autonomous is the execution and the adaptation, not the intent. The Agency also notes the tool was not designed for malicious activity.

Does the affected company have to notify it?

Yes, and it did. Article 33 of the GDPR requires notifying the supervisory authority within 72 hours of any personal data breach likely to result in a risk to individuals' rights, regardless of whether the attacker is a human, a script or an agent.

Does the AI Act change anything?

Regulation (EU) 2024/1689 regulates providers and deployers of AI systems, not those who use them to attack. For the attacked company, the applicable rule is still the GDPR and, if it is an essential or important entity, NIS2.

Find out how long an agent would take to get into your application

At Secra we reproduce this scenario with a web application pentest focused on authentication and access control, or with a red team exercise with credential-based initial access, and we deliver the real time to impact and the controls that would have detected it.

→ Web and mobile application penetration testing

→ Red Team exercises

→ Talk to the team

Related reading

• Agentic AI cyberattacks: 2026 threats: the context of AI-powered techniques.
• Pentesting AI and LLM models: methodology: how a system that integrates agents is audited.
• What is a Red Team: business guide: the exercise that measures your detection time.
• What is an EDR: the automated detection the AEPD recommends.
• Cybersecurity audit for businesses: where to start if you have never had one.