The Spanish Data Protection Agency (AEPD) was notified of an attack allegedly conducted by an AI agent powered by a known large language model (LLM). According to the report, the AI agent autonomously searched for vulnerabilities in generic files, successfully logged into systems, and then probed applications for additional security weaknesses. In the final stages, it modified personal data and accessed financial documents. The AEPD notes that while AI does not introduce new types of threats, it significantly increases the speed, scale, and adaptability of cyberattacks, reducing defenders' response times. This incident underscores the need for revised risk management approaches that explicitly consider AI-driven attacks and the necessity for faster detection, containment, and response mechanisms. The agency also highlights the critical importance of securing digital identities and credentials, as AI agents can exploit compromised accounts and tokens with excessive permissions. The investigation is ongoing, and confirmation of autonomous AI use in the attack is pending. The report also references recent AI agent activities in large-scale cyber operations, illustrating a growing trend of AI-assisted offensive tactics.

The attack resulted in unauthorized access to systems, modification of personal data, and access to financial documents. The use of an AI agent potentially increases the speed and scale of such attacks, enabling rapid vulnerability discovery and exploitation. This can reduce the window for detection and response, potentially leading to broader and more severe data breaches. The incident highlights a shift in the threat landscape where AI-driven automation can amplify the impact of cyberattacks.

The AEPD advises that traditional manual intervention is insufficient against AI-driven attacks. Organizations should strengthen digital identity and credential security to prevent misuse of compromised accounts, API keys, or tokens with excessive permissions. Security models and data protection strategies should be reviewed and updated to explicitly address AI-assisted and AI-driven threats. Fast detection, containment, and response mechanisms are critical to counteract the speed and adaptability of AI-powered attacks. Since the investigation is ongoing and no official patch or fix applies, organizations should monitor vendor advisories for updates and enhance their security posture accordingly.