An organisation has told Spain's data protection authority that an attacker used an AI agent to gain access to its system, modify personal information and access invoices.
The Agencia Española de Protección de Datos (AEPD) announced the notification on 14 September 2026. It was the first breach notification the agency had received in which "the incident would have been executed by means of an artificial intelligence agent that used a well-known language model." The account still required analysis, and the agency did not identify the organisation or the AI model involved.
The reported sequence is the important part of this AI agent data breach: the agent searched for weaknesses, gained access and continued looking for ways to act inside the application.
What happened in the Spanish AI agent data breach?
The AEPD AI agent breach report summarised the attack in four steps. According to the AEPD's post, as translated by BleepingComputer: "The attacking agent began searching for vulnerabilities in generic files and successfully logged in. Once it gained access to the system, it began autonomously searching for vulnerabilities in the application. After finding them, it was able to modify personal data and access invoices."
The agency was careful about two things in this AI agent data breach. The account comes from the affected organisation's own notification and still has to be analysed. And the use of a known AI model does not mean the model or its provider was compromised, or that the tool was built for attacks.
What the AEPD did stress is who was behind it. In its words, "a third party would have used an AI agent as an instrument to successfully chain together different phases of the attack." The AEPD AI agent breach notice puts a person behind the attack and the agent in charge of the steps in between. That is why the Spain data breach AI case matters: it is the first time the regulator has received a report describing an attack this way.
What makes an AI-powered data breach different?
The AEPD separates two kinds of help. An AI-powered data breach is not the same as an attacker using a chatbot. Attackers have used generative models for years to write phishing emails, translate scams, analyse code and look for flaws. That is offensive AI as an assistant. An agent goes further. The agency describes one as a system that "can receive a goal, plan intermediate tasks, use tools, execute code, consult sources, interpret results and modify its behaviour, autonomously, depending on what it finds."
That is what turns an ordinary intrusion into an AI-powered data breach. In the Spain data breach AI case, the notification describes an agent carrying out several attack stages autonomously: finding a way in, then continuing to look for weaknesses once it was inside. It does not establish how much a human intervened along the way, so it is best described as a reported autonomous AI cyberattack, not a proven one.
Is the AEPD AI agent breach the only case?
No. The AEPD AI agent breach is a single report, still under analysis, but the pattern behind it is showing up elsewhere. In July, Palo Alto Networks' Unit 42 described a threat actor who ran the DeepSeek model inside an open-source agent framework against exposed servers. Unit 42 separates the two halves of that campaign: the autonomous AI cyberattack attempts failed, while the same actor's manual attacks succeeded. It still said the system "executed hundreds of hours of manual targeting analysis in mere minutes."
In September, GreyNoise reported a campaign, which began on 31 August, that used hundreds of AI agents to exploit PaperCut print servers at 395 organisations. Each one is a different shape of autonomous AI cyberattack, and each points the same way as the AEPD AI agent breach.
Spain's own National Cryptologic Center reached the same conclusion in June. Its guide on offensive AI, CCN-CERT BP/36, says offensive AI has stopped being an emerging threat and has become "an operational capability integrated into real campaigns" by criminal and state actors. For the Spain data breach AI report, the AEPD put it more plainly: AI "does not create new threats," but it "increases the speed, scale and adaptability" of known ones.
Why speed changes what an AI agent data breach costs
Two weeks after its first post, on 28 September, the AEPD published a second post on offensive AI. It argues that the gap between finding a weakness and using it is close to disappearing, and that the time between first access and data leaving the building is shrinking to "a matter of minutes." In an AI-powered data breach, the time defenders used to have between first access and data loss is what disappears.
These incidents reveal the prize attackers are pursuing. In the Spain data breach AI report, the last step was modifying personal data and accessing invoices. In many organisations, an account that can log in can also open complete documents stored together in one place: contracts, ID scans, payroll files, medical letters. In an AI agent data breach, an agent can work through them at machine speed.
The AEPD's first conclusion was that risk assessments must now account for attacks "assisted or executed by AI," because automation can change the likelihood, speed and reach of an incident. Offensive AI makes reaching the files faster, and the next autonomous AI cyberattack will be faster still. That leaves a storage question: when an autonomous AI cyberattack reaches the files, what is actually there to be found?
The Spain data breach AI case shows why that question now comes first. It is also the problem Untrace Network was built to solve.
What is Untrace Network?
Untrace Network is file storage designed so that a breach of one storage provider cannot expose complete, readable documents.
Each file is encrypted in your browser, then divided into six pieces, called shards, spread across three independent providers. Rebuilding the encrypted file takes any three shards, and reading it requires the decryption key. No single provider holds enough to reconstruct it.
Your personal files deserve to stay personal. Try Untrace Network today to store your contracts, confidential business files and important documents with privacy built in for the agentic era.
What is Untrace's answer to an AI-powered data breach?
Getting into the network does not open the files. Every file is encrypted in the browser, and its key is locked to the people the owner added to that file. Opening it takes the user's passkey, which asks for the person at the device by fingerprint, face or PIN. There is no account-wide key and no server-side key that opens files. An agent that gets a foothold inside an organisation finds no standing credential that unlocks the files stored in Untrace.
A breached provider holds fragments, not files. No single storage provider holds enough shards to reconstruct a file. An agent that compromises one storage provider finds encrypted fragments, not complete invoices, contracts or ID scans.
The storage companies cannot read what they hold. Files are encrypted in the browser before they leave the device, so the providers storing the shards only ever see encrypted pieces.
So, what is Untrace in one line? The practical answer: offensive AI changes the attacker, and Untrace changes what the attacker finds.
Originally published at untrace.network.
Top comments (0)