CLAIM-2026-09-18-02

The AEPD describes the chain as: a search for vulnerabilities in generic files, a successful login, then an autonomous search for vulnerabilities inside the application, which allowed the agent to modify personal data and access invoices.

Why it matters

The chain is the whole practitioner lesson: step two is a successful login, not an exploit. Anyone reading this as a perimeter story has already missed where the control sits.

Sources

• agenciaespa2026primera