Spain's Data Protection Agency Receives Its First Breach Notification Attributed to an Autonomous AI Agent

An unnamed Spanish organization that filed a personal data breach notification with the Agencia Española de Protección de Datos (AEPD)

The AEPD said on September 16, 2026 that it had received a breach notification describing an attack in which "a third party would have used an AI agent as an instrument to successfully chain together different phases of the attack," powered by a known large language model. According to the reporting organization, the agent logged into its systems, searched for vulnerabilities, probed applications for further weaknesses, modified personal data, and accessed invoices and financial documents, with little human steering. The AEPD described it as a qualitative shift, since an agent can "receive a goal, plan intermediate tasks, use tools, execute code, consult sources, interpret results, and modify its actions autonomously," and said that "human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough." The model, the organization, and the volume of data affected were not disclosed, and the investigation is ongoing

Not yet published. The significance is procedural: an agent-driven intrusion has entered the formal GDPR breach notification record, which means regulators now have to reason about intent, attribution, and timelines for attacks where the operator mostly supervised