An AI agent has been blamed for a breach reported to Spain's regulator
single source· 2 articles · confidence: low · first seen 2026-09-16 00:00 UTC
What this means for you
Too early to act on. The agency has named no agent, no vendor and no affected organisation, so there is nothing to patch or avoid. If you deploy agents with access to personal data, the signal is that a national regulator has treated an agent-run breach as a reportable incident — but this file gives no detail about how it happened.
Spain's data protection agency has received the first reported notification of a personal data breach allegedly carried out by an AI agent, according to Reuters, which reported the case on 15 September. SecurityWeek says the AEPD published details of the incident, and describes the breach as executed through an agent by design. The accounts differ over whether the agent acted as intended or was misused; the investigation is continuing. The agency has not named the agent, the system behind it or the organisation affected, and no figures for affected records have been released.
Key facts
- ·Spain's data protection agency received the first reported notification of a personal data breach allegedly carried out by an AI agent source
- ·The case was reported from Madrid on 15 September 2026 source
- ·The AEPD published details of the notification, according to SecurityWeek source
- ·SecurityWeek describes the breach as executed through an AI agent by design source
- ·The investigation into the attack is continuing source
What the sources say
- AI Incident Database (aggregator) — Cites Reuters' Madrid report that the notification was received, not yet adjudicated.
- AI Incident Database (aggregator) — Cites a SecurityWeek account saying the agency published case details and treats the agent's role as deliberate.
Sources
The original reporting. Follow these — they did the work.
- AI Incident DatabaseFirst Agentic AI Data Breach Reported to Spanish Regulator2026-09-16
- AI Incident DatabaseSpanish data watchdog publicises first AI agent-linked data breach report2026-09-16