Spain's privacy regulator investigates an AI agent-driven cyber attack

Spain's privacy regulator is investigating a cyber attack that was driven by an AI agent, according to a report by teiss. Details of the probe — who was targeted, what data was involved and which legal provisions are at issue — are not clear from the available information.

The significance lies in the category of the case rather than its specifics. This is not a story about AI being used as one more tool in an attacker's kit; it describes an intrusion where an agent performed actions on its own, which forces data protection authorities to reason about a chain of events that no human executed step by step.

That is an awkward question for regulators. Privacy law is built around controllers and processors, purposes and legal bases, all of which assume that someone made a decision. An agent that plans and executes multi-step tasks strains each of those categories at once.

The investigative interest also reflects how quickly agents have moved into production. Assistants now hold credentials for browsers, inboxes, internal systems and code repositories. The more access an agent has, the more consequential the question of who is accountable when something goes wrong.

European regulators have spent recent years building out the scaffolding for these questions through GDPR enforcement and new AI-specific legislation, but how those regimes apply to autonomously operating agents is still being worked out.

For companies running agents inside their own environments, the practical takeaway is that logging, least-privilege access and human approval gates stop being hygiene items and become the evidence base for explaining what happened after an incident.

What to watch: whether the investigation produces a public finding, and whether the regulator issues guidance on agent deployments as a result. Either way, the case is likely to become a reference point for how privacy authorities handle agent-driven incidents.