AI Agent Reportedly Exploited Application Vulnerabilities to Modify Personal Data and Access Invoices in Breach Reported to Spanish Data Protection Authority

An unnamed organization reportedly notified Spain's data protection authority that a third party used an AI agent powered by a known language model to carry out a multistep intrusion that resulted in unauthorized changes to personal data and access to invoices. The AEPD said the case remains under review and has not identified the organization, attacker, AI system, attack date, or number of affected people.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

A malicious third party used an AI agent to gain unauthorized access, modify personal data, and view billing records for potential personal advantage or fraud, targeting a specific organization's system.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The autonomous AI agent successfully accessed, viewed, and modified non-public personal data and billing invoices of individuals within the targeted system.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The cyberattack was intentionally initiated and orchestrated by a human malicious actor (a third party) using an AI agent as an instrument to breach the system.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is described as an AI agent using a widely known large language model (LLM) or chatbot-class technology, which falls under transparency and limited risk obligations unless specifically deployed in high-risk use cases.

AI system and alleged parties

• AI system: AI agent
• AI purpose: Automatic Fault Handling; Code Generation
• Behaviour type: Agent
• Alleged developer: Large language model developers, AI agent system developers
• Alleged deployer: Threat actors, Cybercriminals, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Victims of automated cybercrime, Privacy, Organizations, Organization affected by AI-agent data breach reported to AEPD, Information security, Enterprise IT systems

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes a personal data breach where an AI agent modified personal data and accessed invoices.

Directly caused: The AI agent successfully accessed and modified personal data and viewed billing records of individuals within the targeted system.

Inferred additional harm: Depending on the size of the targeted organization, the personal data and financial details of numerous customers or employees were likely exposed to the malicious actor.

People affected

• Occurrences reported: 1
• People reportedly exposed: 100

Potential causes

Management

• Poor Testing Environment Security: Possible escape of a model from an insecurely configured testing environment.
• Inadequate Vulnerability Patching: Management failed to ensure swift patching of known system weaknesses.

Technology

• Autonomous Agent Tool Use: The AI agent successfully chained tasks, executed code, and used tools.
• Bypassed Model Guardrails: The attacker bypassed the LLM provider controls, potentially via jailbreaks.
• Exploitable Application Vulnerability: The system hosted unpatched flaws that the AI agent autonomously scanned.

Data Inputs

• Compromised Credentials: The AI agent used a valid login and credentials to gain initial access.
• Excessive Permissions: The API key or account had broad permissions, exposing billing records.

Human Factors

• Malicious Human Operator: A bad actor directed the AI agent toward a target system to steal data.
• Lack of Real-time Human Oversight: Manual supervision failed to match the sub-second speed of the AI agent.

Process and Methods

• Inadequate Risk Assessments: Existing risk models did not account for autonomous AI-driven cyberattacks.
• Manual Incident Response: Defense relied on manual intervention, which was too slow for AI attacks.
• Weak Identity Management: Insufficient controls over digital IDs, tokens, and access privileges.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Spain's official data protection agency (AEPD) and major news outlets provide consistent, clear details about the nature of the attack, the autonomous behavior of the AI agent, and the specific actions it took inside the system. While the specific LLM and targeted organization are kept confidential, the technical description of the agentic behavior is explicit.
• Ambiguities identified: The specific large language model used and the identity of the targeted organization are not disclosed.
• Alternative interpretations: None. The reports consistently describe a malicious third-party cyberattack utilizing an autonomous AI agent.

This incident marks the first recorded cyberattack executed by an autonomous AI agent, which successfully logged in, scanned for vulnerabilities, and altered personal data in Spain. While the national security impact remains minor due to the localized nature of the target, the transition to autonomous, multi-stage AI-driven cyber threats establishes a significant and highly novel precedent.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: Spain
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident is an isolated, resolved breach under active investigation, representing an ongoing strategic capability concern rather than an active, escalating crisis.
• Autonomy: Full autonomy. The AI agent executed the multi-stage attack autonomously, including logging in, scanning for vulnerabilities, exploiting weaknesses, and modifying data with limited human intervention.
• Novelty: First-of-its-kind. This is the first officially reported real-world cyberattack executed by an autonomous AI agent, marking a qualitative shift from static tools to self-planning threats.

Impact by dimension

• Physical security: Negligible. The attack targeted personal data and billing records of a standard organization, with no disruption to physical systems, critical infrastructure, or human safety.
• Information security: Minor. While the incident involved unauthorized data access and modification, it targeted commercial personal and billing data rather than classified intelligence or state secrets.
• Sovereignty: Negligible. The breach affected a commercial or local entity and did not disrupt government decision-making, electoral systems, or sovereign state operations.
• Economic security: Minor. The compromise of billing records presents localized financial fraud risks, but does not threaten national economic stability, strategic industries, or critical supply chains.
• Societal stability: Minor. The incident represents a privacy violation involving personal data exposure, but lacks the scale to cause civil unrest, systematic discrimination, or mass societal instability.