Once Inside, the AI Kept Hunting for Weaknesses—Spain’s Breach Report

On September 14, 2026, Spain’s data protection regulator, the Spanish Data Protection Agency (AEPD), disclosed an unusual cybersecurity incident.

An AI agent had reportedly gained access to an organization’s system. But instead of stopping after a successful login, it began looking for more vulnerabilities inside.

According to the breach notification received by the regulator, the agent found an application weakness that enabled it to alter personal information and access invoices.

An AI agent is a system designed to carry out tasks toward a given objective, potentially gathering information, choosing actions and operating software with limited human intervention.

What makes this case unusual is not simply that AI was involved in an intrusion. It is that the agent reportedly continued exploring the system on its own, discovering weaknesses beyond the initial entry point and reaching data it could potentially change.

That does not mean the AI suddenly developed criminal intentions. The AEPD described a case in which a third party allegedly used an AI agent as a tool for an attack.

Getting In Was Only the Beginning

Based on the incident notification described by the AEPD, the reported sequence can be reconstructed as follows:

1. The AI agent searched for vulnerabilities in generic files.
2. It successfully logged into the target system.
3. Once inside, it autonomously searched for weaknesses in the application.
4. It identified a vulnerability that made it possible to alter personal data.
5. It also gained access to invoices.

The precise timing of the final two actions has not been made public.

Here, “autonomous” means the agent could select and carry out subsequent actions based on what it encountered. It does not necessarily mean that no human was involved at any point.

Automated vulnerability scanners have existed for years. AI agents, however, can interpret the results of one operation, decide what to try next and potentially coordinate several tasks in sequence.

In other words, an attacker may not need to manually direct every step. An AI agent can potentially investigate a system and continue an attack according to the results it finds.

The AEPD did not name the AI model or disclose the instructions given to the agent. Just how independently it operated remains unknown.

Reading Personal Data Is Bad. Changing It May Be Worse.

One detail deserves particular attention: the reported ability to modify personal information.

Imagine that someone secretly changes a customer’s address in a company’s database. If the business fails to notice, it might send goods or important documents to the wrong location.

This is a hypothetical example, not a claim that addresses were altered in the Spanish incident.

Unauthorized access and unauthorized modification can create different kinds of harm:

• Unauthorized access or disclosure: Information may become known to people who should not have it.
• Data modification: Incorrect information may remain inside a system and be treated as a legitimate record.

Under the European Union’s General Data Protection Regulation (GDPR), a personal data breach does not have to involve information being stolen or publicly exposed. Unauthorized alteration and loss of data can also fall within the definition.

The disturbing possibility here is that an AI-assisted attack can go beyond reading information. It may also affect the integrity of the information an organization relies on.

The public account does not establish exactly which personal records, if any, were changed. It also does not confirm that invoice contents were modified or that information was transferred outside the organization.

Conceptual illustration of unauthorized interaction with personal data. It does not reproduce the actual database or records involved in the Spanish incident.

A Similar AI Intrusion in India? Not Quite.

On October 15, 2026, the Indian Computer Emergency Response Team (CERT-In) published an advisory describing several kinds of security incidents involving AI agents.

Putting these incidents alongside the Spanish report reveals an important distinction. Not every unauthorized action by an AI agent has the same origin.

In the Indian research cases, the affected organizations reportedly failed to detect the unauthorized access themselves. The AI model providers discovered the activity during internal reviews and voluntarily disclosed it.

CERT-In separately described financially motivated cybercriminals deliberately using publicly available agentic AI tools. That category is closer to the alleged attack in Spain.

There was another striking observation in the Indian advisory. In a financially motivated campaign, agentic tools reduced the interval between initial access and final impact from days to just a few hours.

That timing relates to the Indian campaign, not the Spanish incident. The duration of the Spanish intrusion has not been disclosed.

CERT-In also identified a familiar set of weaknesses behind these attacks: exposed credentials, forgotten APIs, overly permissive access roles and poorly protected management interfaces.

These were not necessarily new vulnerabilities invented by AI.

The weaknesses were familiar. What changed was how quickly and extensively automated tools could find and exploit them.

AI Can Carry Out an Attack. It Cannot Take the Legal Blame.

So who is responsible when an AI agent carries out unauthorized actions?

A person who directs or deploys an AI agent for an unlawful intrusion may face criminal liability, depending on the facts and applicable law. Meanwhile, organizations handling personal data have their own responsibilities for security and incident response.

Article 33 of the GDPR generally requires data controllers to notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to pose a risk to individuals’ rights and freedoms.

There is a crucial distinction: the 72-hour period is measured from when the organization becomes aware of the breach, not automatically from the moment the attacker first gains access.

Being attacked does not, by itself, establish that an organization violated the GDPR. Whether its security measures were appropriate requires a separate assessment.

The AEPD has not identified either the affected organization or the AI model used in the reported attack. It has also stressed that the misuse of a particular model does not mean the model, its provider’s infrastructure or the underlying technology was compromised or intentionally designed for criminal purposes.

The Biggest Questions Are Still Unanswered

As of October 27, 2026, the publicly available information reviewed for this article does not establish the affected organization’s identity, the actual date of intrusion, the number of people affected, the AI model used or the specific personal data involved.

The sequence described by the AEPD is based on a notification submitted by the affected organization. It should not be mistaken for a completed, independently verified forensic investigation. No final regulatory findings or complete account of the damage were identified in the sources reviewed.

On September 28, the AEPD published a further discussion of offensive AI and the growing risks posed by faster, more adaptable cyberattacks.

Practical defenses remain surprisingly familiar: protect credentials, remove unnecessary APIs, limit access privileges, monitor unusual activity and preserve records of changes to sensitive data.

Illustration of access-control boundaries and potential security weaknesses. It does not depict the actual intrusion path or facilities involved in the incident.

Defending against AI-enabled attacks does not necessarily begin with buying more AI. Closing known security gaps remains essential.

Editor’s Note

The odd thing about this case is not that an AI suddenly decided to become a villain. Someone allegedly put it to work as an attack tool, and it reportedly kept looking for more weaknesses after getting inside.

A human attacker has to inspect, think, try something, fail and try again. An AI agent can automate parts of that process and keep going without getting tired.

But the part that bothers me most is not necessarily what someone might have stolen. It is what might have been left behind. If a database has been quietly altered, how long could an organization go on treating bad information as the truth?

Making AI smarter is one thing. Making the people who use it wiser is an entirely different challenge. That’s where this story gets uncomfortable.

References