{
 "public_id": "AIR-2026-0240",
 "incident_id": "2026-09-aepd-first-ai-agent-data-breach-notification",
 "date_disclosed": "2026-09-14",
 "date_occurred": null,
 "title": "Spain's AEPD receives the first personal-data breach notification in which an AI agent autonomously chained a login, vulnerability discovery, personal-data modification and invoice access",
 "class": "in_the_wild",
 "attack_surface": "other",
 "initial_vector": "attacker_operated_llm_agent",
 "agent_capability_abused": [
  "autonomous_vulnerability_discovery",
  "code_execution",
  "tool_use",
  "data_modification",
  "authenticated_session_use"
 ],
 "target_product": "Unnamed web application of a Spanish data controller",
 "target_vendor": "Undisclosed (Spanish organization)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "unauthorized_access",
  "data_integrity_loss",
  "information_disclosure"
 ],
 "blast_radius": "one Spanish organization's application; personal data modified and invoices accessed; number of affected people not disclosed",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "ai_operated_intrusion",
   "regulatory_notification",
   "first_of_kind",
   "attacker_uplift",
   "machine_speed_offense",
   "gdpr_breach_notification"
  ]
 },
 "defense_present": "unknown; the agent obtained a valid login before searching for application vulnerabilities",
 "defense_bypassed": true,
 "fix_shipped": "none disclosed; AEPD says the notification is under analysis",
 "primary_sources": [
  "https://www.aepd.es/prensa-y-comunicacion/blog/primera-notiviacion-brecha-datos-personales-causada-por-ataque-ejecutado-mediante-agente-ia",
  "https://www.securityweek.com/first-agentic-ai-data-breach-reported-to-spanish-regulator/",
  "https://cincodias.elpais.com/companias/2026-09-16/primera-brecha-de-dato-ejecutada-por-un-agente-de-inteligencia-artificial-de-forma-autonoma.html",
  "https://incidentdatabase.ai/cite/1693"
 ],
 "verified_quote": "El agente atacante inició una búsqueda de vulnerabilidades en archivos genéricos, y realizó un login correcto. Una vez accedió al sistema, comenzó a buscar, de forma autónoma, vulnerabilidades en la aplicación, lo que, una vez conseguido, le permitió modificar datos personales y acceder a facturas.",
 "confidence": "high",
 "notes": "First-party source is the AEPD blog post (14 Sep 2026, signed Francisco Pérez Bes); quote is Spanish and translates: the attacking agent began a search for vulnerabilities in generic files and performed a correct login; once inside it autonomously searched for application vulnerabilities which, once found, let it modify personal data and access invoices. The AEPD does NOT name the victim organization, the attacker, the agent framework or the model ('un conocido modelo de lenguaje'), the attack date, or the number of affected people, and stresses the information comes from the controller's own notification and is still under analysis; it also says use of a given model does not imply the model or provider infrastructure was compromised. SecurityWeek (Kevin Townsend, 16 Sep) calls it the first known agentic attack outside a rogue frontier-model evaluation agent; CyberVerse CTO Simon Phillips cautions there is not enough information to know how the breach was carried out. Cinco Días (15 Sep, Ramón Muñoz) reports the notification was received 'este lunes' (Mon 14 Sep). Reuters coverage is paywalled. autonomy_level coded semi_autonomous: the agent chained phases autonomously inside an operator-set goal, but the source does not establish a persistent unattended loop. AI Incident Database incident 1693.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy",
  "legal_ip"
 ],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover",
  "Unauthorized financial commitment"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent autonomously chained login, vulnerability discovery and data modification",
 "vector_family": "other",
 "vector_detail": "attacker_operated_llm_agent",
 "guardrail_kind": [
  "authentication"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [
   1693
  ],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "sensitive_data_exposure"
 ],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (vector=code_exec); ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}