An AI agent logged in, then kept looking

Researchers and regulators have warned for some time that attackers would use AI agents. A regulator has now received a breach notification saying one did.

Spain's data protection authority, the AEPD, said in a post on 14 September that it had received its first notification of a personal data breach caused by an attack executed through an AI agent built on a well-known large language model. It did not identify the organisation that reported it or the model involved.

The sequence the agency describes is short. The agent began by searching generic files for vulnerabilities. It then logged in successfully. After that it searched the application for vulnerabilities on its own, and what it found let it modify personal data and access invoices.

The middle step is the one to read twice. A successful login is not an exploit; it is a credential that worked. The AEPD does not say where the credential came from. The order it describes suggests the agent found something usable before it logged in, and only then began probing the application from the inside.

Nothing in that chain is new technique. Credentials left where they can be read and applications that trust a logged-in session too much are the two oldest findings in any penetration test. What the agent changes is the cost of trying: the patient, file-by-file search that used to require a person's attention can now be run continuously and cheaply.

The agency was careful about what it has established. It has yet to investigate and verify the account, and it stressed that the use of a particular AI model does not mean that the model or its provider's infrastructure was compromised. The tool was used, not breached.

Its conclusion was nonetheless blunt. AI-related data breaches are "no longer merely theoretical", the AEPD said, as translated by BleepingComputer, and "manual intervention is no longer sufficient, and human oversight should be supported by fast detection, containment, and response mechanisms."

That second sentence is the operational point. An attacker that moves at machine speed after its first successful login shortens the time between access and damage below what a human-staffed alert queue can react to. Detection that pages someone for review is designed for an intruder who pauses.

The agency's recommendations follow from that: treat AI-executed attacks as an explicit scenario in risk assessments, review response times, strengthen the management of digital identities, and automate detection and containment while keeping people in the loop. This desk argued earlier this month that organisations should treat their own agents as privileged users. The Spanish case is the mirror image: the attacker's agent was a user too, the moment the login worked.

A first notification is a measure of reporting, not of incidence. The more useful question is how many earlier breaches involved an agent that nobody recognised as one, and the AEPD's post is likely to make the next organisations that see this pattern more willing to say so.