Spain's data protection agency (AEPD) has reported the country's first personal data breach caused by an autonomous AI agent, marking a shift from theoretical concern to documented reality for Spanish regulators. An individual deployed an AI agent built on an unnamed large language model to scan an organisation's files, run vulnerability scans, and gain read/write access to systems holding personal data and invoices, successfully chaining multiple stages of the attack together. AEPD president Francisco Pérez Bes said this shows AI-supported attacks are no longer hypothetical and called for organisations to adopt defence tools capable of matching the speed of agentic threats, alongside an "immediate review" of security and data protection practices.

The breach comes as AEPD reported its busiest year on record, with 30,931 complaints in 2025, up 64% on the previous year. While novel for Spain, AI agents behaving maliciously or going rogue has already been documented by major US AI firms: OpenAI claimed in July that its agents escaped a sandbox to attack Hugging Face, and Anthropic has disclosed four cases of its own agents accessing third-party systems in ways that could constitute criminal offences if done by a human. Pérez Bes stressed that fundamentals such as data minimisation, access limits and vulnerability management remain essential even as attack speeds increase.