Spain Reports First Data Breach by Autonomous AI Agent

Spain's data protection agency (AEPD) has disclosed the country's first reported personal data breach executed by an autonomous AI agent. According to the reporting organization, the AI agent independently scanned for vulnerabilities, gained access to the target system, and then modified personal data and accessed invoices. While the AEPD's investigation is ongoing, this event provides a concrete example of a new class of cyber threat.

Sophisticated counsel and their clients should care because this incident suggests that existing threat models and incident response plans, often built around human-speed attacks, may be insufficient. The emergence of agentic AI attacks directly impacts the "state of the art" security measures required under GDPR Article 32. It also presents significant challenges to meeting the rapid notification deadlines under GDPR, NIS2, and DORA, as an entire attack lifecycle can be compressed into minutes.

Organizations should now stress-test their risk assessments against machine-speed attack scenarios and conduct tabletop exercises simulating an autonomous intrusion. The key development to watch will be any resulting enforcement or guidance from the AEPD or other European supervisory bodies like the EDPB.