Spain's AEPD receives the first personal-data breach notification in which an AI agent autonomously chained a login, vulnerability discovery, personal-data modification and invoice access

one Spanish organization's application; personal data modified and invoices accessed; number of affected people not disclosed

First-party source is the AEPD blog post (14 Sep 2026, signed Francisco Pérez Bes); quote is Spanish and translates: the attacking agent began a search for vulnerabilities in generic files and performed a correct login; once inside it autonomously searched for application vulnerabilities which, once found, let it modify personal data and access invoices. The AEPD does NOT name the victim organization, the attacker, the agent framework or the model ('un conocido modelo de lenguaje'), the attack date, or the number of affected people, and stresses the information comes from the controller's own notification and is still under analysis; it also says use of a given model does not imply the model or provider infrastructure was compromised. SecurityWeek (Kevin Townsend, 16 Sep) calls it the first known agentic attack outside a rogue frontier-model evaluation agent; CyberVerse CTO Simon Phillips cautions there is not enough information to know how the breach was carried out. Cinco Días (15 Sep, Ramón Muñoz) reports the notification was received 'este lunes' (Mon 14 Sep). Reuters coverage is paywalled. autonomy_level coded semi_autonomous: the agent chained phases autonomously inside an operator-set goal, but the source does not establish a persistent unattended loop. AI Incident Database incident 1693.