Lessons From Spain's First Reported Agentic AI Data Breach

Earlier this month, the Spanish data protection regulator (AEPD) disclosed that it had received the first notification of a personal data breach in which the incident had reportedly been executed using an AI agent that used a known large language model (LLM). The incident raises a question that organisations across Europe will increasingly need to confront: whether their cybersecurity and breach response measures remain adequate when attackers can deploy autonomous AI tools.

According to information provided by the affected organisation, the agent began by searching for vulnerabilities in generic files and successfully logged in to the organisation’s system. Once inside, it autonomously searched for vulnerabilities in the application and, after identifying one, was able to modify personal data and access invoices.

At the time of writing, the incident has not appeared in European Data Protection Board (EDPB) plenary communications or European Commission publications. The AEPD has stressed that its account relies on information provided by the notifying organisation and remains subject to the regulator’s analysis, and it has not publicly identified the organisation, the attacker or the particular AI model used. The AEPD has also made clear that the use of a particular AI model does not mean that the model or its provider’s infrastructure was compromised, or that the tool was designed for malicious purposes.

But what the AEPD has described is a multi-stage intrusion in which the agent apparently used an LLM to scan for and identify vulnerabilities, successfully logged in to the organisation’s system and then autonomously searched for vulnerabilities in the application. After identifying a vulnerability, it modified personal data and accessed invoices. The AEPD has not disclosed publicly whether data were exfiltrated, whether further categories of data were reached and how the organisation detected the intrusion. Nor has it publicly described any lateral movement within the organisation’s environment. 

However, this does not appear to be a case in which the AI model itself was compromised, but rather one in which a threat actor deployed an AI agent as an autonomous attack tool. 

The agentic AI threat landscape

In its TechSonar 2025–2026 report, the European Data Protection Supervisor (EDPS) described agentic AI as systems that “can autonomously make decisions, take actions and achieve goals without constant human intervention”. That autonomy, the EDPS noted, “opens a new area in which AI systems built for different purposes and technologies can cooperate to achieve a common goal”. The Spanish incident suggests that the same capabilities can also be deployed for hostile purposes.

Indeed, CERT-EU’s Cyber Brief for July 2026 included several cases of autonomous AI agents being used in attacks on live systems. CERT-EU reported that an autonomous AI agent framework had enabled an OpenAI LLM model to escape a sandboxed testing environment and compromise Hugging Face’s servers, exploiting two code execution vulnerabilities, stealing cloud and cluster credentials and moving laterally across internal clusters. CERT-EU also reported an LLM-driven extortion operation, known as JADEPUFFER, in which a threat actor exploited an exposed Langflow service, harvested credentials and pivoted into a production environment to seize control of configuration services and databases. 

Separately, CERT-EU reported three incidents in which Claude models, during third-party capture-the-flag evaluations, unexpectedly reached the public internet and gained unauthorised access to three organisations’ production systems. And the European Insurance and Occupational Pensions Authority (EIOPA), the EU’s insurance and occupational pensions supervisor, made a similar observation, noting that advanced AI systems “may also increase the sophistication of cyberattacks, automated fraud and social engineering techniques, making cyber risk more dynamic and potentially more difficult to model using traditional actuarial approaches”. (Asset managers, in particular, face heightened exposure to these evolving social engineering and fraud techniques, as we have written recently.)

All of which point to the fact that autonomous agents — whether weaponised or operating through capabilities that were not originally intended for offensive use — can chain exploitation, credential theft and lateral movement at machine speed, albeit the AEPD’s account of the Spanish incident does not, at least publicly, establish that the agent carried out lateral movement or credential theft. Nevertheless, for organisations that are subject to the GDPR, the question is not whether the attacker was human or AI, but whether the organisation's security measures remain appropriate to the threat environment as it actually exists.

Does the threat model need to change?

Article 32 of the GDPR requires controllers and processors to implement technical and organisational measures that ensure a level of security appropriate to the risk, taking into account the state of the art, costs of implementation, the nature, scope, context and purposes of processing, and the risk of varying likelihood and severity for the rights and freedoms of natural persons. The assessment must account for risks from “accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed”, and Article 32(1)(d) requires organisations to maintain “a process for regularly testing, assessing and evaluating the effectiveness” of those measures.

Article 32 does not prescribe controls for AI-enabled attacks any more than for ransomware or phishing. But the emergence of agentic AI may change the inputs to an organisation’s risk assessment. To be clear, Article 32 does not require organisations to deploy AI-powered defences — nor would the involvement of an AI agent in an attack necessarily mean that the organisation’s measures were inadequate. But organisations should be asking whether their threat models account for:

• automated vulnerability discovery and exploitation;

• attacks conducted at machine speed;

• autonomous lateral movement between systems;

• automated access to and exfiltration of personal data; and

• attacks that can adapt in response to defensive measures.

The question under Article 32 — are the measures appropriate to the risk? — has not changed. What may be changing is the risk itself.

The incident response challenge

Agentic attacks introduce additional challenges at the point at which Articles 33 and 34 require organisations to assess and respond to a breach. Article 33(1) of the GDPR requires the controller to notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware” of a breach, unless it is “unlikely to result in a risk to the rights and freedoms of natural persons”. Article 34(1) adds a further obligation to communicate to affected individuals where the breach is likely to result in a “high risk to the rights and freedoms of natural persons”. Both obligations presuppose that the organisation can assess the breach quickly, but an agentic intrusion may challenge that assumption in four specific ways.

• A human attacker may move through a network over hours, days or even months, generating forensic artefacts at each stage. By contrast, an autonomous agent can chain vulnerability exploitation, credential harvesting and lateral movement in minutes, compressing the attack lifecycle into a timeframe that may be shorter than the organisation's detection cycle. By the time the intrusion is identified, the agent may already have traversed multiple systems. Scoping which personal data was reached becomes much harder when the attack window is measured in minutes rather than days.

• Unlike scripted malware or a human attacker following a predetermined path, an agentic system can make real-time decisions about which systems to target, which vulnerabilities to exploit and how to respond to defensive measures. The forensic trail may therefore not follow a linear or predictable pattern, meaning that reconstructing what the agent did becomes a different forensic problem from tracing conventional intrusions.

• Standard forensic analysis relies on system logs, network telemetry and endpoint detection data to map an attacker's movements. But an autonomous agent may interact with systems in ways that generate ambiguous or incomplete log entries, particularly if its actions are rapid enough to overlap or if it operates through legitimate application interfaces rather than known exploits. Organisations may find that their logging infrastructure does not capture sufficient detail to reconstruct an agent's autonomous decision chain.

• With a human attacker, containment typically involves identifying and severing the attacker’s access. With an autonomous agent, an additional question arises: has the agent fully ceased activity, or has it established persistence mechanisms, spawned secondary processes or deposited payloads that will execute later? The CERT-EU incidents described above, including a reported sandbox escape and separate examples of persistence and lateral movement, illustrate the range of containment issues that may arise in an agentic intrusion.

Article 33(4) of the GDPR allows notification in phases where complete information is not immediately available, and the EDPB’s Guidelines 9/2022 confirm that phased notification is “a safe way to meet the notification obligations” when the full extent of a breach is still unknown. But the gap between an initial notification of uncertain scope and subsequent updates providing the information required by Article 33(3) may be wider in an agentic incident than in a conventional breach. Organisations should test whether their response plans address this challenge:

• Can compromised systems and credentials be isolated faster than an autonomous agent can move laterally?

• Do logging and telemetry systems capture sufficient detail to reconstruct an agent’s autonomous decision chain, including interactions with legitimate application interfaces?

• Does forensic capability extend to identifying persistence mechanisms, staged payloads or secondary agent processes that may survive initial containment?

• Are privacy teams brought in at the point of detection, so that the Article 33 and Article 34 assessments begin in parallel with technical containment, rather than waiting for a complete forensic picture that may take weeks to assemble?

• Is there a protocol for making the initial phased notification under Article 33(4) in circumstances where the scope of the breach remains  uncertain because the agent’s behaviour has not yet been reconstructed?

What should organisations do now?

The AEPD’s report does not create new law, and it is too early to know whether the affected organisation met its Article 32 GDPR obligations or whether enforcement action will follow. But the incident offers a concrete scenario against which organisations can stress-test their existing programmes, and there are three steps they should consider:

• Pressure-test the Article 32 risk assessment against an autonomous attacker. Organisations should consider whether their threat models reflect an attacker that can operate at machine speed, chain exploits without human intervention and adapt its approach in real time. Has the Article 32 assessment, which must take account of the “state of the art” and the “risk of varying likelihood and severity”, been updated to reflect reported incidents involving autonomous AI attacks on production infrastructure? Article 32(1)(d) also requires organisations to regularly test and assess the effectiveness of their security measures, and that testing should take account of how the threat environment is changing.

• Tabletop an agentic AI-specific scenario. The exercise should consider a scenario in which an AI agent identifies and exploits a vulnerability, moves between systems without human direction, adapts when it encounters a defensive control, and accesses personal data across several databases, all before the security team has had time to assess the initial alert. Additionally, the exercise should test whether the organisation can detect and contain the intrusion quickly enough to limit machine-speed lateral movement, establish the scope of the breach well enough to make assessments under Articles 33 and 34 of the GDPR, as well as, where applicable, to meet the NIS2 Directive’s (NIS2) 24-hour early-warning requirement and the Digital Operational Resilience Act’s (DORA) four-hour classification and notification deadlines.

• Map regulatory reporting requirements with agentic-AI attacks in mind. The speed of an agentic attack may leave little time for organisations to assess the scope of an incident, determine which reporting obligations apply and make the necessary notifications in sequence. Organisations subject to the GDPR and other EU regimes, including NIS2 and DORA, should identify in advance the relevant thresholds, deadlines and authorities for plausible agentic AI scenarios. This can help ensure that the different regulatory assessments start as soon as an incident is detected, rather than one waiting for another to be completed.

The Spanish incident does not create a new category of GDPR breach, given that the law already applies when an attacker — human or otherwise — obtains unauthorised access to personal data. But it brings into practical focus what has been theoretically foreseeable: that the “state of the art” against which Article 32 measures security now arguably includes a threat environment in which autonomous AI agents are actively used to scan for vulnerabilities, exploit them and move through systems without human direction.

The obligation under Article 32(1)(d) to regularly test and evaluate the effectiveness of security measures cannot be satisfied by testing against yesterday’s threat landscape. Given that autonomous agents are being documented — by CERT-EU, the EDPS, EIOPA and now the AEPD — as tools that chain exploits at machine speed, traverse production infrastructure and compromise personal data, the assumptions underpinning organisations' security assessments should be revisited. The Spanish incident is an early signal, and it is unlikely to be the last.

Subscribe to Ropes & Gray Viewpoints by topic here.