Overview
- Spain’s data protection agency said Monday it received a notification that an AI agent allegedly logged into a system, searched for vulnerabilities, modified personal data and accessed invoices.
- The AEPD is reviewing the report and has not identified the large language model, the model’s provider or the organization that notified the agency.
- The regulator warned that using a model does not prove the model or its provider was compromised and said AI increases the speed, scale and adaptability of existing cyber threats.
- Security specialists listed plausible causes that investigators are considering, including bypassed model guardrails, a model escaping a testing environment, or unauthorized use by a penetration tester.
- The report follows other recent agentic incidents and has prompted calls for faster incident response, stronger credential protections and AI-assisted detection tools to protect people’s personal data.