Spain's data watchdog reviews an AI-agent-linked breach report.

Spain's data protection authority, the AEPD, disclosed the first breach notification it has received in which an AI agent allegedly performed multiple stages of an intrusion with limited human intervention. The reported activity included identifying a vulnerability, accessing a system, changing personal data and viewing invoices.

The regulator says the notification remains under review and did not identify the affected organization, model or provider. It also stressed that the report does not mean the model or its provider's infrastructure was compromised, or that the technology was created for malicious use.