Spain’s data protection authority has reported what could be an early real-world example of an AI agent being used to carry out multiple stages of a cyberattack, including gaining access to an account, identifying a vulnerability and reaching personal data.
The Spanish Data Protection Agency (AEPD) said the incident involved an AI agent that allegedly connected several attack steps with limited human direction. However, the investigation remains ongoing, and the regulator has been cautious about drawing definitive conclusions about how the attack was conducted.
AI Agent Allegedly Chained Multiple Attack Steps
According to the AEPD, the incident involved a successful login followed by vulnerability discovery, modification of personal information and access to invoices containing personal data.
The agency said the significant issue from a data protection perspective was the reported use of an AI agent to connect different stages of the intrusion.
Unlike conventional AI-assisted cyberattacks, where AI may be used for individual tasks such as generating phishing emails or automating reconnaissance, an agentic system can potentially plan and execute a sequence of actions based on the results it obtains.
The AEPD described agents as systems capable of receiving a goal, breaking it into intermediate tasks, using external tools, executing code, consulting information and adjusting their actions autonomously.
Incident Could Signal a New Cybersecurity Challenge
AI-assisted cybercrime has already become increasingly common, particularly in phishing, social engineering, deepfakes and automated attack operations.
The Spanish incident is potentially different because the AI system reportedly participated in a chain of activities that progressed from authentication to vulnerability discovery and access to sensitive information.
The AEPD indicated that this development could require organizations to reconsider how they assess cybersecurity and data protection risks.
However, the available information does not establish exactly how much autonomy the AI system had or whether the agent itself independently initiated the entire operation.
Security Experts Urge Caution
Simon Phillips, CTO at CyberVerse, said the incident should be examined carefully rather than being presented as evidence that AI systems are independently “running rogue.”
Phillips identified several possible explanations, including an attacker deliberately bypassing an AI model’s safeguards, an AI system escaping a poorly configured testing environment, or a penetration-testing model being used without authorization.
He said determining which scenario occurred will be important for understanding the security implications and deciding where organizations should strengthen their defenses.
The possibility of an attacker deliberately bypassing an AI model’s safeguards would raise particular concerns because it could indicate that existing controls were insufficient to prevent the system from being used for unauthorized activity.
Four Areas of Risk Management Need Greater Attention
The AEPD highlighted several areas organizations should consider as AI agents become more capable.
First, organizations should include AI-assisted attacks and adversarial AI agents in cybersecurity risk assessments.
Second, security teams may need to improve incident detection and response times, as autonomous systems can potentially operate much faster than traditional human-led attacks.
Third, organizations should strengthen protections around digital identities, credentials and authentication mechanisms, which can provide attackers with an entry point into sensitive systems.
Finally, the agency indicated that defensive measures cannot rely entirely on manual intervention.
Human Oversight Remains Important
The AEPD emphasized that human supervision continues to be necessary, but said it should be supported by automated systems capable of detecting, containing and responding to threats quickly.
This could lead to greater use of AI-assisted defensive technologies alongside human security teams, particularly for monitoring autonomous activity and responding to rapidly developing incidents.
At the same time, organizations will need safeguards around defensive AI systems themselves to prevent automated actions from creating additional risks.
Investigation Will Determine the Full Impact
The AEPD’s report does not yet establish whether the incident represents a broader trend in autonomous cyberattacks or an isolated case.
Further investigation will be necessary to determine how the AI agent was configured, what level of human involvement was present, how vulnerabilities were identified and how personal data was ultimately accessed.
The incident nevertheless highlights a growing cybersecurity concern: as AI agents gain the ability to plan tasks, use tools and respond to changing conditions, defenders may increasingly need to account for attacks that combine automation with adaptive decision-making.
