Spain’s data protection agency said it received the first reported notification of a personal-data breach allegedly carried out by an AI agent using a known LLM; the case remains under review.
Spain’s Data Protection Agency (AEPD) said it has received the first reported notification of a personal-data breach allegedly carried out by an artificial intelligence agent, Reuters reported from Madrid. The agency described the case in a blog post Monday; Reuters carried the account Tuesday.
According to AEPD, the incident allegedly involved an AI agent using a widely known large language model to identify vulnerabilities, gain access to a system, modify personal data, and access invoices. The affected organization reported the alleged breach. The information remains under review. AEPD did not identify the LLM or the organization targeted, Reuters said, and did not immediately respond to a Reuters request for further comment.
The agency stressed that use of a particular AI model does not mean the model itself or its provider’s infrastructure was compromised, or that the technology was built for malicious purposes. It said the case matters because a third party allegedly used an AI agent to carry out multiple stages of an attack with limited human intervention.
Per the notification, the agent allegedly logged into the system, then autonomously searched for application weaknesses before altering personal information and viewing billing records. AEPD said a single case is not enough to establish a broader statistical trend, but that the notification suggests AI-assisted attacks are moving beyond theory into real-world personal-data processing. It added that AI does not create new threats so much as it increases the speed, scale, and adaptability of existing malicious techniques.
This brief covers AEPD’s reported notification as carried by Reuters. It does not treat the alleged breach as a finished finding.