The Spanish Data Protection Agency has reported the first data breach in Spain executed end-to-end by an AI agent (Source: securityweek.com).
The agent did reconnaissance, logged in, probed the application and modified data with no human operator at any step.
That is what is new. Until now, the cases that got published always had a person deciding the next move, even remotely and with a model's help.
Not here. The agent closed the entire chain.
The same week, researchers at Hacktron documented another chain worth reading slowly (Source: securityweek.com).
It started in libheif, the library that decodes HEIF images, and in ImageMagick, the classic conversion tool. A flaw in that image processing opened the first door.
The second door was not a flaw, it was a configuration. OpenAI's SSO was misconfigured, and that misconfiguration let the chain keep moving into internal repositories.
They used Claude Opus 5 to build the exploit.
Look at the sequence. A flaw in a decoding dependency, a service that shares identity with another, and an AI tool that speeds up the hard part. None of the three steps is exotic on its own. Together they form a chain that enters where nobody looks.
What stands out is not the sophistication. It is that the chain holds on pieces that have been in any company's inventory for years.
Both stories share a shape. An agent or an automated chain walks through steps that used to require human hands, and it does so at a speed classic controls were not designed to see.
In the AEPD case, the agent needed nothing strange. It did what a patient attacker would do, but without s and without getting tired.
In the Hacktron case, the AI did not replace the attacker. It took away the heavy work of building the exploit, which is exactly the part that used to filter out amateurs.
I have checked it myself, without being an expert in anything: the entry barrier is now very low and the volume of attempts rises.
AI agents as attackers? The agent is also the attacker's tool, and this week there are two clear examples.
The first is Hacktron, with Claude Opus 5 building the exploit.
The second is LeakySensey, an attacker who compromised more than 87,000 IP addresses through brute force against devices with PPTP and L2TP and credentials like admin123 (Sources: escudodigital.com, cybernews).
He rented them as proxies and made 202,000 dollars since 2024. He automated the operation with a modified version of Claude Code, presumably local.
There is the direction that matters. It is not that AI attacks on its own, it is that a single operator scales what used to require a team.
My reading is that the problem is not the agent's autonomy, it is the surface we leave for it. And skipping the catastrophic tone.
A misconfigured SSO is a door you share between services. If the agent enters through it, it enters all of them at once.
An unpatched decoding dependency is a door almost nobody looks at. libheif does not come up in risk meetings.
And a VPN with PPTP or L2TP and default credentials is a door that has been open for years and nobody has closed because nobody uses it.
The three controls that would have stopped these attacks are concrete. Phishing-resistant MFA, isolation of services that share SSO, and patching of image decoding dependencies.
None is expensive. None is new. The problem is that none is on this week's priority list.
I would set up a container with an old version of ImageMagick and libheif, feed it malformed HEIF images and see what happens.
I would do it on an isolated network, with no internet egress, because the goal is to see the behavior, not to reproduce the exploit.
I would watch whether the process crashes, whether it writes anything outside its directory or whether it opens a connection it should not.
With that I would have a cheap conclusion. If the service that decodes images has write permissions where it should not, the library flaw stops being a flaw and becomes a breach.
The lesson of the week is not that AI attacks on its own. It is that the doors we have left open for years are now walked through at a speed we had not seen.
Closing three of them costs less than explaining why we did not.
Originally published at https://sammideblas.com/notas/ai-agent-runs-first-end-to-end-breach-in-spain