Spain Reports First AI Agent Data Breach: What Happened and Why It Matters Updated: September 16, 2026 Artificial intelligence is increasingly being used to write code, analyze systems and automate cybersecurity tasks. But a new incident in Spain shows the technology can also become part of a cyberattack. Spain's Data Protection Agency (AEPD) has received what it describes as the first notification of a personal-data breach in Spain in which the attack was allegedly carried out using an AI agent . According to the AEPD, an AI agent using a known large language model was able to search for vulnerabilities, gain access to an application, continue looking for weaknesses autonomously, modify personal data and access invoices. The case is still under review, so the details should be treated as an ongoing investigation rather than a fully established account of the attack. What Happened in Spain? The incident reportedly began when a third party used an AI agent during a cyberattack. Acc...