Spanish data agency reports first breach in Spain run end-to-end by an AI agent

Spanish regulator reports a breach with no human in the loop

Spain's Data Protection Agency (AEPD) has reported the first data breach in the country executed end-to-end by an AI agent, according to a post on dev.to that cites SecurityWeek. The agent performed reconnaissance on the target, logged in, probed the application and modified data, with no human operator involved at any stage.

What makes the case a first, the post argues, is not the involvement of AI but the absence of a person. Previously published incidents that used models in intrusions always had a human deciding the next move, even remotely and with machine assistance. In the Spanish case, the agent closed the entire chain on its own.

The dev.to item is a personal write-up and the underlying details arrive secondhand via SecurityWeek, so the AEPD's own documentation has not been independently reviewed here. The affected system and the nature of the modified data are not described in the post.

Two more AI-driven chains surfaced the same week

The post also points to research attributed to a group called Hacktron, again via SecurityWeek, documenting a chain that started with a flaw in libheif, the library that decodes HEIF images, and in ImageMagick, the long-standing conversion tool. The second step was not a flaw at all but a configuration problem: OpenAI's SSO was misconfigured, and that misconfiguration let the chain keep moving into internal repositories. The exploit was built using Claude Opus 5.

None of the individual pieces is exotic, the post notes. A flaw in a decoding dependency, an identity service shared with other services, and an AI tool that compresses the hardest part of the work together form a path that enters where few organisations look, built on components that have sat in inventories for years.

A third example in the post concerns an actor nicknamed LeakySensey who, according to sources it cites (escudodigital.com and Cybernews), compromised more than 87,000 IP addresses by brute-forcing devices exposing PPTP and L2TP with default credentials such as admin123. The addresses were rented out as proxies, earning the attacker 202,000 dollars since 2024, and the operation was automated with a modified version of Claude Code, presumably run locally.

The common shape: machine speed against legacy surface

The author sees a shared pattern across the cases: an agent or automated chain walks through steps that used to require human hands, at a speed classic controls were not designed to observe. In the AEPD case the agent needed nothing unusual; it did what a patient attacker would do, but without pauses and without tiring.

In the Hacktron case, the AI did not replace the attacker so much as remove the heavy work of building the exploit, which the post describes as the part that historically filtered out amateurs. The author writes that they checked this personally, without being an expert, and found the entry barrier is now very low and the volume of attempts is rising. The direction that matters is not that AI attacks on its own, but that a single operator can scale what used to require a team.

The controls that would have helped

The post's closing argument is that the problem is the attack surface left open, not the agent's autonomy, and it lists concrete measures. Phishing-resistant multi-factor authentication would raise the cost of the login step. Services that share a single sign-on provider should be split by criticality, so that a failure in one does not grant access to the rest.

Image-decoding dependencies such as libheif and ImageMagick process files anyone can upload, so they should be patched and the services using them stripped of excess permissions. Inventories should also be audited for stale PPTP and L2TP VPN endpoints still exposed with default credentials. The author's point is that none of these controls is expensive or novel; the failure is prioritisation.

Why it matters

If the AEPD report stands, it marks a shift in the threat model: AI in security moves from an amplifier that assists human attackers to, in at least one documented case, an autonomous actor executing a full intrusion. Detection and response practices that assume human pacing, dwell time, fatigue and error degrade quickly under that assumption.

The other lesson is more mundane. The chain described ran on a misconfigured SSO, an unpatched decoding library and default VPN credentials, none of which would make a risk review. For defenders, the practical response is hygiene rather than novel anti-AI tooling. For regulators, the incident sets a precedent for how breaches caused by autonomous agents are investigated and reported under data protection law.