Spain’s Agencia Española de Protección de Datos (AEPD) blog (14 September 2026; Francisco Pérez Bes) reports the agency’s first notification of a personal-data breach in which the incident was allegedly executed by an AI agent using a known large language model. Per the notifier: the agent searched generic files for vulnerabilities, successfully logged in, then autonomously hunted application flaws, modified personal data, and accessed invoices.

AEPD stresses the claim is from the organisation’s notification, has not yet been independently verified by the agency and still requires analysis; use of a given model does not imply the provider’s model or infrastructure was compromised or purpose-built for crime. Framing: shift from AI-assisted attacker tools (phishing copy, vuln search) toward agentic chaining of attack phases at machine speed — with implications for identity/credential controls, detection, and response timing.

According to BleepingComputer, AEPD said AI can increase the speed, scale and adaptability of attacks and reduce defenders’ response-time margins, a paradigm shift recently highlighted by Spain’s National Cryptologic Center. (source: AEPD blog)

Updated 16 Sep 2026: BleepingComputer reported the AEPD post on 16 September.

Correction (27 Oct 2026): a second card on the same AEPD notice has been merged into this one and removed; an earlier Perth conversion of BleepingComputer's time has been dropped because the page states no time zone. (source: BleepingComputer)