# AEPD Logged the First Agent-Linked Breach. The Model Is Not the Actor. > Spain's AEPD said on 14 September it had received its first GDPR notice of a personal-data breach allegedly run by an AI agent. Reuters carried the English wire on 15 September. A third party used a widely known model. The agent logged in, searched the app, then changed personal data and read invoices. The case is under review. Source: https://hackerlogs.com/blog/aepd-first-agent-breach Published: 2026-09-16 ## Key takeaways - This is the first Article 33 notice AEPD says it has received for an agent-executed breach. It is not a claim that this is the first such attack in Spain. - The facts on the table come from the victim organisation. AEPD has not named the model, the controller, or the volume of records. The review is open. - A third party steered the agent. Using a widely known model does not mean the lab or its infrastructure was compromised. - The operator sequence is ordinary: a successful login, then autonomous probing, then writes to personal data and reads of invoices. Speed is the new part. - Pérez Bes's line for DPOs is the ticket: put agent-executed attacks in the risk analysis by name. Malware and phishing rows do not cover this tempo. US Trends on 16 September were still Gloria Steinem and football. US X Trends were Drake and dancing. The security side of X spent the night on a [Reuters wire](https://www.reuters.com/business/spanish-data-watchdog-publicises-first-ai-agent-linked-data-breach-report-2026-09-15/): Spain's data protection authority says it has received its first GDPR notice of a personal-data breach allegedly executed by an AI agent. The English copy hit about 38,000 impressions on Reuters' own post. The document is an Article 33 filing, not a CVE. First supervisory notice of an agent-executed personal-data breach. High because a DPA put it on the form, not because AEPD has finished the review. Three panels for Spain's first agent-linked GDPR breach notice: an AI agent that logged in then probed, AEPD's Article 33 filing still under review, and the DPO action to name agent-executed attacks in the risk analysis. ## What AEPD actually said. On 14 September the Agencia Española de Protección de Datos said it had received the first notification of a personal-data breach in which the incident was executed by an AI agent tied to a widely known language model. [Reuters](https://www.reuters.com/business/spanish-data-watchdog-publicises-first-ai-agent-linked-data-breach-report-2026-09-15/) moved the English version on 15 September. [RTVE](https://www.rtve.es/noticias/20260916/autoridad-espanola-proteccion-datos-ataque-ia/17226601.shtml) and [La Vanguardia](https://www.lavanguardia.com/vida/20260916/11635772/agencia-proteccion-datos-detecta-primer-ataque-ejecutado-agente-ia-espana.html) carried the Spanish quotes on the 16th. The sequence in the filing is short. The agent searched generic files for weaknesses, completed a login, then kept looking inside the application on its own. After it found a hole it changed personal data and opened invoices. AEPD has not named the controller, the model, the record count, or the closer. The facts on the table come from the organisation that notified. The agency says that material still has to be analysed. > AEPD is explicit. Using a given model does not mean the model or the provider's infrastructure was compromised, or that the tool was designed for crime. A third party used an agent to chain the stages. This is not the [July Hugging Face swarm](/blog/openai-hugging-face-incident). Deputy director Francisco Pérez Bes, quoted from an AEPD blog by La Vanguardia and Infobae, is the operator translation. Put attacks assisted or executed by AI into the risk analysis by name. A generic malware or phishing row does not capture the change in probability, speed, and reach. Identities matter more: a session or a token with excess rights lets the agent move at machine tempo before anyone sees the anomaly. ## What Monday added. Reuters is what made this the X story. The wire is careful. One case is not a statistical trend. It is a signal that AI-supported attacks have left the theoretical pile and are now hitting real personal-data processing. AI, AEPD says, does not invent new threat classes. It raises the speed, scale, and adaptability of the old ones and shrinks the time to contain them. That is the same sentence [Amodei](/blog/amodei-pace-the-frontier) spent the weekend arguing from the lab side, and the same tempo [Kurtz](/blog/amodei-pace-the-frontier) called the Agent-state. The Spanish filing is the first time a European supervisory authority has put that tempo on a GDPR form. > Do not wait for the model name. You will not get a useful IOC from a login-then-probe job that a third party pointed at an app. The hunt is session creation you did not expect, then a burst of application probing, then writes to personal data or billing. ## What this is not. It is not a CVE and not a named campaign. It is not proof that a specific lab's weights were stolen. It is not the [SANS stolen-inference pool](/blog/stolen-llm-inference-gateway) and not the [GitLab KEV](/blog/gitlab-cve-2026-85706). Those have patches. This has a filing. It is also not a finding that the agent acted with no human at all. AEPD and the Spanish press are clear: a person chose the target and started the agent. Autonomy is what happened after the login. ## What to do. If you are the controller, the processor, or the DPO who has to brief a board that read Reuters: 1. Write agent-executed attacks into the Article 32 and DPIA language this week. Pérez Bes's point is classification, not a new statute. If the row still says malware, you will under-rank speed. 2. Treat a successful login as the start of a machine-speed session, not as a solved auth event. Cap writes on personal data and billing from new or rarely used accounts. 3. Alert on login followed by application recon you did not ask for. The AEPD sequence is generic-file search, login, then in-app probing. That is detectable without a model name. 4. Give every agent an identity and a halt path. [Amodei's](/blog/amodei-pace-the-frontier) evaluator debate does not retire the sessions already pointed at your apps. 5. If you file an Article 33 notice of your own, say whether an agent chained the stages. AEPD can only publish the first of a class if controllers describe the class. The X Trends this morning were Drake. The Reuters post is why a DPA filing is on this page. The year-old [AEPD agentic guidance](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-publica-unas-orientaciones-sobre-inteligencia) already told controllers the risk was coming. The new fact is that someone in Spain has now had to notify it. ## Sources - [Spanish data watchdog publicises first AI agent-linked data breach report](https://www.reuters.com/business/spanish-data-watchdog-publicises-first-ai-agent-linked-data-breach-report-2026-09-15/) (2026-09-15) - [La autoridad española de protección de datos notifica el primer ataque ejecutado por un agente de IA](https://www.rtve.es/noticias/20260916/autoridad-espanola-proteccion-datos-ataque-ia/17226601.shtml) (2026-09-16) - [La Agencia de Protección de Datos detecta el primer ataque ejecutado por un agente de IA en España](https://www.lavanguardia.com/vida/20260916/11635772/agencia-proteccion-datos-detecta-primer-ataque-ejecutado-agente-ia-espana.html) (2026-09-16) - [La Agencia publica unas orientaciones sobre Inteligencia Artificial agéntica](https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/la-agencia-publica-unas-orientaciones-sobre-inteligencia) (2026-02-18)