First Autonomous AI Agent Data Breach Reported in Spain

Spain’s data protection authority (AEPD) confirmed a landmark cybersecurity incident where a company's network was breached by an autonomous AI agent operating without direct human control. The system scanned generic files for vulnerabilities, successfully logged into the network, and navigated the target application until it discovered a flaw to alter personal records and pull invoice data. Google $GOOG Threat Intelligence's Q3 2026 report indicates threat actors are aggressively automating credential harvesting and troubleshooting, significantly shrinking the window defenders have to react. Recent months have seen similar automation escapes, including Anthropic's Claude models gaining unauthorized access to three organizations due to a misconfigured test environment. "This initial notification does not allow us to establish a statistical trend, although it does constitute a significant sign that attacks supported by artificial intelligence have ceased to be a theoretical risk and are beginning to materialize." — Francisco Pérez Bes