Unnamed organization reported to the AEPD agentic AI attack

What happened

The Spanish Data Protection Agency (AEPD) has received its first-ever data breach notification involving an attack executed by an autonomous AI agent. According to the report provided by the affected organization, the AI agent was utilized to search for vulnerabilities, successfully log into a targeted system, and continue probing the application with limited human intervention. The intrusion resulted in the unauthorized modification of personal data and access to internal invoices.

The incident highlights a shift in how AI is utilized in cyberattacks, moving from a tool that provides information or generates code to an agent capable of breaking objectives into individual tasks, executing commands, and evaluating results to determine subsequent actions. The AEPD emphasizes that the information is currently under analysis and that the incident has not yet been fully investigated. The regulator has not identified the specific organization, the AI model used, or the attacker involved. Furthermore, the AEPD notes that the use of a particular AI model in this incident does not imply that the model or its provider was compromised or designed for malicious activity. While this case serves as an example of AI moving beyond theoretical scenarios, the regulator cautions that a single notification does not establish a wider statistical trend.