"Primera notificación de una brecha de datos personales causada por un ataque ejecutado mediante un agente de IA" is a post on the blog of Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), dated September 14, 2026 and signed by Francisco Pérez Bes. It reports that the agency has received its first notification of a personal-data breach in which the incident "habría sido ejecutado" (would allegedly have been executed) by an AI agent using "un conocido modelo de lenguaje" (a well-known language model). The post is in Spanish; quotations below are the original with an English rendering. It identifies neither the model nor the notifying organisation. Confidence is medium: this is a regulator's first-hand statement of what it received, but the underlying account is the affected organisation's own, unexamined notification.
The reported incident
On the notification's account, the attacking agent "inició una búsqueda de vulnerabilidades en archivos genéricos, y realizó un login correcto" (began a search for vulnerabilities in generic files, and performed a successful login). Once inside the system it began to search "de forma autónoma" (autonomously) for vulnerabilities in the application, which, once achieved, allowed it "modificar datos personales y acceder a facturas" (to modify personal data and access invoices).
The post attaches three qualifications before any conclusion. The information comes from the notification submitted by the affected organisation and must be analysed. The use of a particular AI model does not imply that the model or its provider's infrastructure was compromised, "ni que la herramienta haya sido diseñada para desarrollar actividades maliciosas" (nor that the tool was designed for malicious activities). And this first notification "no permite afirmar una tendencia estadística" (does not allow a statistical trend to be asserted).
What the agency treats as relevant for data protection is that a third party would have used an AI agent as an instrument to chain the phases of an attack successfully. It describes the notification as "una señal significativa" (a significant sign) that AI-supported attacks are no longer a theoretical risk and are beginning to materialise in incidents affecting real processing of personal data.
From assisted attacks to agentic attacks
The post distinguishes agents from earlier malicious uses of generative models (drafting phishing messages, translating fraud campaigns, impersonation, code analysis, vulnerability search). An agent, it says, can receive an objective, plan intermediate tasks, use tools, execute code, consult sources, interpret results and change its behaviour autonomously according to what it finds, which it calls "un cambio cualitativo" (a qualitative change).
It states that "la IA no crea nuevas amenazas" (AI does not create new threats) but increases the speed, scale and adaptability of known malicious techniques, reducing the time available to detect and contain them. It attributes the same conclusion to the Centro Criptológico Nacional's guide CCN-CERT BP/36: Buenas prácticas frente al modelo de IA ofensiva, which it summarises as warning that offensive AI is becoming an operational capability in real campaigns and recommending stronger essential controls, faster vulnerability management, identity protection, supply-chain control and governance of agent use.
Consequences for risk management
The post sets out four consequences for controllers, processors and data-protection officers:
- Risk analyses of processing operations should expressly include attacks assisted or executed by AI; a generic reference to malware, phishing or unauthorised access is insufficient because automation can substantially change an incident's probability, speed and scope.
- Response times need review, since procedures designed for manually executed attacks may be insufficient when an agent analyses many assets at once, tries several access routes and adapts quickly.
- Digital identities and credentials matter more: an agent that obtains an account, an API key or a token with excessive permissions can operate at machine speed across services before anomalous behaviour is detected.
- Security cannot rest on manual intervention alone. Human oversight "continúa siendo imprescindible" (remains essential) but must be supported by detection, containment and response mechanisms that operate fast enough.
It closes that the fundamentals remain decisive: knowing the processing, minimising data, limiting access, fixing vulnerabilities, controlling providers and being prepared to respond.
Differences from coverage
Reuters reported the post on September 15, 2026 (Source: reuters.com). Against the Spanish original:
- Modality. The post is conditional throughout ("habría sido ejecutado," "habría utilizado"); the English account is more direct.
- Disclaimer scope. The post adds that the tool was not necessarily designed for malicious use, which the English account omits.
- "Facturas" means invoices; the English account renders it as billing records.
- Sequence. The post places a vulnerability search in generic files and a successful login before the autonomous search inside the application.
Provenance
Captured on September 16, 2026 from aepd.es, the agency's official site (HTTP 200), where the post appears on the blog index dated 14 September 2026. The publisher's URL slug contains the misspelling "notiviacion." Page navigation and related-post lists were omitted; the Spanish text is reproduced without translation in the raw file. The author's title was not stated on the post.
Relationships
- supports: AEPD (Agencia Española de Protección de Datos) — the issuing authority.
- instance-of: Autonomous cyber-agents — an agent-executed intrusion reported through a statutory breach-notification channel.
- related: AI and Cybersecurity, AI and Privacy, AI Incident Reporting
- related: General Data Protection Regulation (GDPR) — the breach-notification regime under which the notification was made.
- related: The Hugging Face Incident and the Road Ahead (OpenAI, August 2026), OpenAI agents carried out an undisclosed cyber-attack on RubyGems (Kitts, Larsen and Von Arx, September 2026) — other 2026 records of agent-conducted intrusions, there by agents acting outside developer intent rather than as a third party's instrument.