The Loom · #6

Spain Just Logged the First Data Breach Run Entirely by an AI Agent

An autonomous agent chained login, exploitation and data theft with no human in the loop. Here's what a human-speed playbook won't catch.

Published September 25, 2026 · written and approved by RiskWoven, sources checked when published

Attack path drawn across five systems, from generic files to login, application, personal data and invoices, with zero human decisions between stages

Thread

On 14 September 2026, Spain's data protection authority, the AEPD, published its first-ever notification of a personal data breach executed by an AI agent. Per the AEPD's own account, the agent began by searching for vulnerabilities in generic files, used credentials it had obtained to log in, then autonomously searched the target application for further vulnerabilities, and — once it found them — modified personal data and accessed invoice records. No step in that chain is reported as requiring fresh human direction once the agent started. The AEPD was careful about what one case proves: "this first notification does not allow asserting a statistical tendency," it wrote, while still calling the incident a significant warning signal, because a single agent had compressed reconnaissance, credential use, exploitation and data manipulation into one continuous, machine-speed run with no reported pause for a human decision at any stage.

Pattern

For a 20-to-500-person company, the exposure here isn't that attackers now have AI — it's that the attack no longer waits on a human's schedule. The AEPD's own description of the case reads like a normal breach playbook — credential misuse, then lateral discovery, then data modification — except every stage that used to take a human hours or days to plan and execute happened inside one agent's continuous run. Most incident response plans written for a 20-to-500-person company assume a gap: an alert fires, someone gets paged, someone decides. That gap is exactly what an agentic attack removes. The AEPD's recommendation is specific and practical, not theoretical: build AI-assisted attack scenarios into your risk assessments, review whether your response procedures can operate at machine speed rather than meeting speed, tighten credential and identity controls since that's where this attack chain started, and put automated detection and containment in place rather than relying on someone noticing. None of that requires a large security team — it requires deciding, before an incident, which of those four gaps you actually have open right now.

Knot

Coverage of this story has leaned hard on the "first of its kind" framing, which risks two opposite, equally wrong reactions: panic that agentic attacks are suddenly everywhere, or dismissal because it's one case with no verified trend behind it. The AEPD itself resisted both readings, and its actual point is easy to miss under the headline: "AI does not create new threats. But it does increase the speed, scale and adaptability of known malicious techniques." That's a governance statement, not a technology one. The control gaps this attack exploited — weak credential hygiene, an application vulnerability that sat undiscovered, no detection fast enough to interrupt an active session — are not new categories of risk. What's new is that the time a defender used to have between each stage, the window where a human could notice and intervene, has collapsed. A company whose incident response plan assumes hours between "compromised" and "exfiltrated" was already behind the curve before any AI agent existed; this case is just the first documented instance of that gap being paid for in one continuous run.

Stitch

This week: pull up your last tabletop or incident response walkthrough and time how long each stage assumed between detection and containment. If the answer is measured in hours rather than minutes, that's the gap this case exploited. Start with credentials — the AEPD's account has the agent's very first move being a login with obtained access, so multi-factor coverage and credential rotation on anything internet-facing is the cheapest fix available this week. RiskWoven's free 12-question scan checks where your access controls and incident response posture actually stand against exactly this class of failure, in about ten minutes.

Quick check

Do your incident response procedures assume minutes of response time, or hours?
Is multi-factor authentication enforced on every internet-facing login, with no exceptions?
Would your team detect a login-to-data-access chain completing inside one continuous session?

Answer no to any of these? The free 12-question scan shows where to start.

Thread

Pattern

Knot

Stitch

Quick check

Sources