The (AEPD) has received its first notification of a personal data breach executed via an AI agent. Linked to a known language model, the agent was used by a third party to develop phases of a cyberattack and modify personal data.
A human selected the target and activated the agent, which searched for vulnerabilities in generic files and logged into an application. It then autonomously examined security flaws and accessed invoices. The AEPD has not named the entity or the model used.
The AEPD warns that automation modifies the probability, speed, and scope of incidents. Organisations are now urged to incorporate AI-supported attacks into risk analyses, as the number of people affected by this specific breach remains currently unspecified.