Spanish privacy agency receives the country's first breach report run by an AI agent
single source· 2 articles · confidence: low · first seen 2026-09-16 00:00 UTC
What this means for you
Nothing to act on yet. No victim, no AI system, no technique beyond a successful login has been published, so there is nothing to change in a defensive setup because of this. Watch for the AEPD's technical write-up, if it comes — a regulator's account of an agent-run intrusion would be the first detailed one.
Spain's data protection authority, the AEPD, has received what it calls the country's first notification of a personal data breach in which the attack was run by an AI agent. The agency's own account says the agent scanned generic files for vulnerabilities, made a successful login, then searched the application autonomously for further weaknesses. Cinco Días reported the notification on 16 September 2026; both items in this cluster are AI Incident Database entries for the same case. Neither account names the affected organisation, the data involved, or the system behind the agent.
Key facts
- ·Spain's AEPD received the first notification of a personal data breach in the country in which the attack was run by an AI agent. source
- ·The attacking agent searched generic files for vulnerabilities before making a successful login. source
- ·After gaining access, the agent searched the application autonomously for further vulnerabilities. source
- ·The notification was reported on 16 September 2026. source
- ·The AI Incident Database catalogues the case as incident 1693. source
What the sources say
- AI Incident Database (aggregator) — Regulator's own write-up, walking through the intrusion: file scan, successful login, then autonomous probing of the application.
- AI Incident Database (aggregator) — News report framing it as Spain's first such notification, with the agency as source and few technical particulars.
Sources
The original reporting. Follow these — they did the work.
- AI Incident DatabasePrimera brecha de datos ejecutada por un agente de inteligencia artificial de forma autónoma2026-09-16
- AI Incident DatabasePrimera notificación de una brecha de datos personales causada por un ataque ejecutado mediante un agente de IA2026-09-16