Skip to content
ROAI

September 16, 2026 · Issue 31 · 4 min read

Spain's regulator logged its first breach run by an AI agent, and changed what an adequate risk analysis looks like

Spain's data protection authority, the AEPD, says it has received its first notification of a personal data breach that the reporting organization attributes to an AI agent. According to the agency's own post(opens in a new tab), the agent ran on a well-known language model, searched generic files for weaknesses, logged in successfully, then hunted for vulnerabilities in the application on its own. Once it found one, it modified personal data and accessed invoices. The organization and the model were not named.

The AEPD is careful about what this proves. One notification is not a trend, the facts come from the victim's report and are still under analysis, and using a given model does not mean its provider was compromised. The part a General Counsel should read is what the agency concludes anyway. It says controllers should now name AI-assisted and AI-executed attacks explicitly in their risk analyses, review response times that were designed around manual attacks, tighten identity and credential management, and add detection and containment that can act at machine speed. In its words, the security of processing cannot depend solely on manual intervention.

That matters because European data protection law requires security measures appropriate to the risks of the processing. A regulator has now put in writing which risk it expects that assessment to include. A risk register that still treats agents as a productivity topic, and not as a threat actor, is the document a future investigation will read first.

The same week produced the other half of the problem, with no attacker involved. The Mandiant and Google Threat Intelligence Group report covered by Help Net Security(opens in a new tab) describes an accounting agent that entered a runaway loop and made more than 15,000 high-cost API calls in under an hour, generating about $50,000 in cloud charges and disrupting live transactions. Same speed, same absence of a human in the loop, different line on the income statement.

Both cases defeat the same control. Most incident playbooks assume someone notices within hours and acts. An agent finishes its work in minutes. The practical fix is unglamorous: hard limits set in advance, per agent, on spend, call volume, and the permissions it holds.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

Three questions come out of the AEPD post, and each has an owner who can answer it this month.

First, for the risk and privacy team. Does your current data protection risk analysis name AI-executed attacks anywhere, or does it rely on a generic line about malware and phishing? The regulator has said which of those it considers adequate.

Second, for security operations. How long does your incident playbook assume it takes to notice and contain an intrusion, and was that number set with a human attacker in mind? An agent that logs in, finds a flaw, and alters records does not wait for the morning shift.

Third, for whoever owns the AI budget. Does every production agent have a hard ceiling on spend and call volume that trips without anyone watching? The Mandiant case shows the same missing control produces a breach in one company and a surprise invoice in another.

None of this requires new tooling to start. It requires writing down limits before an agent tests them.

Also worth knowing