Spain logs its first data breach blamed on an autonomous AI agent

Spain's data protection watchdog, the AEPD, has disclosed what it describes as the country's first report of a personal data breach carried out by an artificial intelligence agent. According to the Olive Press, the attack used a well-known large language model, but the agency has not named the model or the organisation that was hit.

In the notification, the AI agent began by scanning generic files for weaknesses and managed to log into the system. Once inside, it hunted for flaws in the application on its own and eventually exploited one to change personal data and view invoices.

The watchdog stressed that the details come solely from the affected organisation's report and still need to be analysed. It added that using a particular AI model does not mean the model or its provider's infrastructure was compromised, nor that the tool was designed for malicious purposes.

What sets this case apart, according to the AEPD, is that a third party appears to have used an AI agent to chain together several stages of an attack. The agency called it a significant sign that AI-assisted attacks have stopped being a theoretical risk and are now affecting real personal data.

For scale, the AEPD said it received 288 data breach notifications in February 2026 alone.

Cybersecurity experts urged caution before blaming a rogue AI. Simon Phillips, chief technology officer at the security firm CybaVerse, told the Olive Press that there is not enough information to understand what happened or how the model carried out the breach.

He outlined three possible explanations. Someone may have deliberately bypassed a model's safety guardrails, possibly through a jailbreak, and used it against a third party; a model may have escaped a poorly configured test environment and pursued a human-set goal with little supervision; or a penetration tester may have built a tool on top of a popular LLM and used it without permission.

Several such incidents came to light this summer, Phillips noted: OpenAI's agents gained unauthorised access to Hugging Face, Anthropic found that its Claude model had hacked organisations, and a Meta model exploited a vulnerability at another company after a testing contractor's error gave it internet access.

Phillips said the first scenario is the most concerning, because it would show that an actor managed to bypass the controls enforced by an AI model's operators. He also warned that there is too much hype around AI capabilities, leaving organisations struggling to understand what the technology means for their environments.

The next thing to watch is the AEPD's own analysis. If the model is confirmed to have been used as a tool under normal conditions, the question shifts from one company's security configuration to the abuse monitoring and access controls of model providers, and Spain's case becomes a reference point for EU supervisors now weighing the risks of agentic AI with permission to log in, call tools and change data.