It did not break in, it logged in — the first agent-executed breach notification, and the limb of Article 4(12) nobody plans for

Spain's AEPD published on 14 September 2026 the first notification of a personal data breach executed by means of an AI agent running on what it calls a well-known language model: the agent searched generic files for vulnerabilities, performed a successful login, then searched the application autonomously from inside, modified personal data and accessed invoices. The obvious reading is an attacker story about someone else's agent, and the agency's own third observation corrects it — the control it names is an account, an API key or a token with excessive permissions, which lets an agent operate at machine speed and reach several services before anomalous behaviour is detected, and that description fits the internal CI, migration and support agents in a normal estate exactly as well as it fits this one. The AEPD is explicit that use of a particular model does not imply the model or its provider's infrastructure was compromised or that the tool was built for malice, so nothing moves to the provider and Article 32 stays with the controller. The second correction is the limb: what happened here was alteration, which Article 4(12) has counted as a personal data breach since 2018, while Article 33(1) allows 72 hours from awareness and Article 33(3)(a) asks for the categories and approximate number of records concerned — a question no confidentiality-shaped playbook can answer. Scale, from the agency's own figures: 2,765 notifications in 2025, 11 escalated, and the AEPD states this one notification does not permit the assertion of a statistical trend. The practitioner move is an inventory of agent tokens that can write, with each write logged against the value it replaced.

Post

Spain's data protection agency has logged the first personal data breach executed by an AI agent. The first thing the agent did was log in successfully.

The AEPD published it on its blog on 14 September. A third party used an agent, running on what the agency calls a well-known language model, to chain the phases of an attack: it scanned generic files for weaknesses, completed a valid login, then searched the application autonomously from the inside, modified personal data and reached invoices.

What this changes for anyone shipping agents in the EU:

The scale first, so nobody oversells it. The AEPD received 2,765 breach notifications in 2025, 80% private sector, and escalated 11 for further investigation. This is one notification, and the agency says so itself: it does not permit anyone to assert a statistical trend.
The agency declines to blame the model. Its own words: using a particular AI model does not imply that the model or its provider's infrastructure was compromised, nor that the tool was designed for malicious activity. The agent was an instrument. Which leaves the duty where it was, on the controller, under Article 32.
The first step was not an exploit. "Realizó un login correcto." Credentials that worked. The agency's third observation names the control: an account, an API key or a token with excessive permissions lets an agent operate at machine speed and reach several services before anyone notices anything anomalous.
That is a description of your own agent platform. The widest-scoped non-human identities in most estates went to internal agents - CI, migrations, support tooling - scoped for convenience. Nothing in point 3 requires the agent to be hostile.
And the breach here was alteration, not exfiltration. Article 4(12) defines a personal data breach as destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Article 33(3)(a) asks for its nature and the approximate number of records concerned. Most playbooks are shaped for confidentiality and have no answer to "which rows did it change, and to what?"

My Monday: list every agent token that can write, and log each write with the value it replaced. Article 33 gives you 72 hours from awareness to describe what changed. That log is what makes an answer possible.

A breach is not only a leak. Which records did your agents change last week?

#DSGVO #AIAct #AgenticAI #EUTech #DevSecOps

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, in the order the argument uses them.

The AEPD's own blog post, 14 September 2026 - the attack chain, the caveat about the model, and the four observations on risk analysis, response times, credentials and manual intervention: https://www.aepd.es/prensa-y-comunicacion/blog/primera-notiviacion-brecha-datos-personales-causada-por-ataque-ejecutado-mediante-agente-ia

The AEPD's press release of 23 January 2026 - 2,765 breach notifications in 2025, the 80/20 split between private and public sector, and the 11 escalated for further investigation: https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-aepd-recibio-en-2025-mas-2.700-notificaciones-brechas

Regulation (EU) 2016/679 on EUR-Lex - Article 4(12) for alteration, Article 32(1)(b) for integrity, and Article 33 for the 72 hours and what the notification has to describe: https://eur-lex.europa.eu/eli/reg/2016/679/oj

CCN-CERT BP/36, June 2026, the offensive-AI good-practice guide the AEPD cites, summarised by the AEPD's own innovation lab: https://laboratorio.aepd.es/novedades/guia-practica-del-ccn-cert-para-hacer-frente-la-ia-ofensiva

Cut for length: the same agency published orientations on agentic AI from a data protection perspective in February 2026, seven months before the first notification arrived. Worth reading next to this one.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

Claims

Sources

Corrections

Coverage dates disagreed with the primary: aggregator coverage placed the AEPD publication on 16 September and one Spanish outlet on 15 September; the AEPD's own blog page is dated 14 September 2026. The primary date is used throughout.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.

It did not break in, it logged in — the first agent-executed breach notification, and the limb of Article 4(12) nobody plans for

Spain's AEPD published on 14 September 2026 the first notification of a personal data breach executed by means of an AI agent running on what it calls a well-known language model: the agent searched generic files for vulnerabilities, performed a successful login, then searched the application autonomously from inside, modified personal data and accessed invoices. The obvious reading is an attacker story about someone else's agent, and the agency's own third observation corrects it — the control it names is an account, an API key or a token with excessive permissions, which lets an agent operate at machine speed and reach several services before anomalous behaviour is detected, and that description fits the internal CI, migration and support agents in a normal estate exactly as well as it fits this one. The AEPD is explicit that use of a particular model does not imply the model or its provider's infrastructure was compromised or that the tool was built for malice, so nothing moves to the provider and Article 32 stays with the controller. The second correction is the limb: what happened here was alteration, which Article 4(12) has counted as a personal data breach since 2018, while Article 33(1) allows 72 hours from awareness and Article 33(3)(a) asks for the categories and approximate number of records concerned — a question no confidentiality-shaped playbook can answer. Scale, from the agency's own figures: 2,765 notifications in 2025, 11 escalated, and the AEPD states this one notification does not permit the assertion of a statistical trend. The practitioner move is an inventory of agent tokens that can write, with each write logged against the value it replaced.

Post

Spain's data protection agency has logged the first personal data breach executed by an AI agent. The first thing the agent did was log in successfully.

What this changes for anyone shipping agents in the EU:

The scale first, so nobody oversells it. The AEPD received 2,765 breach notifications in 2025, 80% private sector, and escalated 11 for further investigation. This is one notification, and the agency says so itself: it does not permit anyone to assert a statistical trend.

The agency declines to blame the model. Its own words: using a particular AI model does not imply that the model or its provider's infrastructure was compromised, nor that the tool was designed for malicious activity. The agent was an instrument. Which leaves the duty where it was, on the controller, under Article 32.

The first step was not an exploit. "Realizó un login correcto." Credentials that worked. The agency's third observation names the control: an account, an API key or a token with excessive permissions lets an agent operate at machine speed and reach several services before anyone notices anything anomalous.

That is a description of your own agent platform. The widest-scoped non-human identities in most estates went to internal agents - CI, migrations, support tooling - scoped for convenience. Nothing in point 3 requires the agent to be hostile.

And the breach here was alteration, not exfiltration. Article 4(12) defines a personal data breach as destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Article 33(3)(a) asks for its nature and the approximate number of records concerned. Most playbooks are shaped for confidentiality and have no answer to "which rows did it change, and to what?"

A breach is not only a leak. Which records did your agents change last week?

#DSGVO #AIAct #AgenticAI #EUTech #DevSecOps

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

First comment

Sources, in the order the argument uses them.

AI disclosure: the narration voice, the cover art and the brand ident animation in this video are AI-generated. The script, the claims and the source checks are mine.

AI disclosure