This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Spain's data protection agency reported the first known cyberattack executed by an autonomous AI agent that successfully logged in, scanned for vulnerabilities, modified personal data, and accessed billing records.
An unnamed organization reportedly notified Spain's data protection authority that a third party used an AI agent powered by a known language model to carry out a multistep intrusion that resulted in unauthorized changes to personal data and access to invoices. The AEPD said the case remains under review and has not identified the organization, attacker, AI system, attack date, or number of affected people.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Also classified as
The autonomous AI agent successfully accessed, viewed, and modified non-public personal data and billing invoices of individuals within the targeted system.
A malicious third party used an AI agent to gain unauthorized access, modify personal data, and view billing records for potential personal advantage or fraud, targeting a specific organization's system.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The cyberattack was intentionally initiated and orchestrated by a human malicious actor (a third party) using an AI agent as an instrument to breach the system.
This incident marks the first recorded cyberattack executed by an autonomous AI agent, which successfully logged in, scanned for vulnerabilities, and altered personal data in Spain. While the national security impact remains minor due to the localized nature of the target, the transition to autonomous, multi-stage AI-driven cyber threats establishes a significant and highly novel precedent.
The report describes the AI system acting autonomously to chain together different phases of an attack. It received a goal, planned intermediate tasks, used tools, executed code, and modified its actions based on what it found.
Limited Risk: The system is described as an AI agent using a widely known large language model (LLM) or chatbot-class technology, which falls under transparency and limited risk obligations unless specifically deployed in high-risk use cases.
The AI agent was used to autonomously scan for application weaknesses and exploit vulnerabilities, which is the offensive equivalent of automatic fault handling and vulnerability analysis.
The reports from Spain's official data protection agency (AEPD) and major news outlets provide consistent, clear details about the nature of the attack, the autonomous behavior of the AI agent, and the specific actions it took inside the system. While the specific LLM and targeted organization are kept confidential, the technical description of the agentic behavior is explicit.
None. The reports consistently describe a malicious third-party cyberattack utilizing an autonomous AI agent.
Technology
Autonomous Agent Tool Use
The AI agent successfully chained tasks, executed code, and used tools.
Bypassed Model Guardrails
The attacker bypassed the LLM provider controls, potentially via jailbreaks.
Exploitable Application Vulnerability
The system hosted unpatched flaws that the AI agent autonomously scanned.
Data Inputs
Compromised Credentials
The AI agent used a valid login and credentials to gain initial access.
Excessive Permissions
The API key or account had broad permissions, exposing billing records.
Human Factors
Malicious Human Operator
A bad actor directed the AI agent toward a target system to steal data.
Lack of Real-time Human Oversight
Manual supervision failed to match the sub-second speed of the AI agent.
Process and Methods
Inadequate Risk Assessments
Existing risk models did not account for autonomous AI-driven cyberattacks.
Manual Incident Response
Defense relied on manual intervention, which was too slow for AI attacks.
Weak Identity Management
Insufficient controls over digital IDs, tokens, and access privileges.
Management
Poor Testing Environment Security
Possible escape of a model from an insecurely configured testing environment.
Inadequate Vulnerability Patching
Management failed to ensure swift patching of known system weaknesses.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
