MADRID, Sept 15 (Reuters) – Spain’s data protection watchdog said it has received the first reported notification of a personal data breach allegedly carried out by an artificial intelligence agent, a case that suggests autonomous systems are beginning to play a direct role in cyberattacks.
The Spanish Data Protection Agency (AEPD) said on Monday in a blog on its website that the incident involved an AI agent using a widely known large language model to identify vulnerabilities, gain access to a system and subsequently modify personal data and access invoices.
The agency said that the alleged breach was reported to it by the affected organization and the information remains under review, adding the use of a particular AI model did not mean either the model itself or its provider’s infrastructure was compromised, nor that the technology was developed for malicious purposes.
AEPD did not immediately respond to a Reuters request for comment, nor identify the large language model or the organization targeted by the breach.
The agency said the case was relevant because a third party allegedly used an AI agent to carry out multiple stages of an attack with limited human intervention, highlighting the growing role of autonomous systems in cybersecurity incidents.
The incident comes as regulators and cybersecurity authorities across the United States and Europe increase scrutiny of the risks posed by increasingly capable AI systems, even as businesses adopt the technology at a rapid pace.
PRIORITISING PUBLIC SAFETY
Spain has positioned itself as one of Europe’s most vocal advocates of a “trustworthy AI” model that protects privacy, democracy, minors and public safety rather than prioritising speed or profit for the tech industry.
While a single case is insufficient to establish a broader trend, the notification suggests that AI-assisted attacks are moving beyond the theoretical stage and are beginning to affect real-world processing of personal data, AEPD added.
According to the notification submitted by the affected organisation, the agent successfully logged into the system before autonomously searching for application weaknesses. After identifying a vulnerability, it was able to alter personal information and view billing records.
The Spanish watchdog did not say when it would finish reviewing the reported breach.
The agency said AI does not create new threats. However, it increases the speed, scale and adaptability of existing malicious techniques, reducing the time available to detect and contain them.
Controllers, processors and data protection officers must prepare for a scenario in which the speed of attacks will continue to increase, the agency added.
(Reporting by Corina Pons; Editing by Aurora Ellis)
Comments