Spain's data watchdog logs first AI-driven personal data breach report

In a blog post dated Sept 14, the Spanish Data Protection Agency (AEPD) disclosed that it had received its first report of a personal data breach executed by an artificial-intelligence agent. The AI leveraged a publicly known large language model to scan for vulnerabilities, infiltrate a system and subsequently alter personal information and view billing records. The breach was reported by the organization that suffered the intrusion, and the agency is still assessing the details.

AEPD emphasized that the incident does not imply the underlying model or its infrastructure were breached, nor that the technology was designed for wrongdoing. Officials said the case is significant because it demonstrates how autonomous systems can conduct multiple attack stages with minimal human input. The watchdog warned that AI amplifies the speed and adaptability of existing threats, urging data controllers and protection officers to prepare for faster attacks. No comment was obtained from the AI model’s provider or the targeted company.