Spain's national data protection authority, enforcing the GDPR and Spanish privacy law and receiving organizations' breach notifications.
Spain's data protection authority said on 14 September 2026 it received its first breach notification blaming an AI agent. The account is the victim's own and still under analysis, so it is enough to add the scenario to a response plan and too thin to size it.
Reality
Spain's AEPD disclosed its first breach notice naming an AI agent as the reported attacker, based on an account the regulator has not verified. Read with cases in Australia and a coding-agent test, it puts the cost for insurers and security teams in the permissions each agent holds.
Reality
Spain's AEPD published the account but has not yet verified it. In it, the agent scanned for flaws, logged in, altered personal data and opened invoices. The agency's own position is that AI adds speed and scale, not new threats.
Perspective Coverage
3 publishersReality
Palo Alto Networks Unit 42 says the pay-per-install marketplace fed gamers and professionals into the same loader, OfferLoader, and its trojanized installers reached corporate endpoints at critical infrastructure and government entities.
Reality
The organization that filed it told the AEPD that the agent searched for flaws, logged in, kept hunting bugs inside the application and then altered personal data and opened invoices, and the regulator has not yet investigated.
Reality
The Spanish agency describes a third party using an agent to chain a successful login, vulnerability discovery, data modification and invoice access, and it published that account while its own investigation is still open.
Reality
Spain's AEPD has not confirmed the sequence, the organization or the agent framework behind the notification it received, and the controls it points builders to were already published in its February 2026 agentic AI guidance.
Reality