On September 14, Spain’s data protection authority received its first breach notification in which an autonomous AI agent — not a human — carried out the entire attack. The agent found credentials, logged in, probed for weaknesses, modified personal records, and accessed invoices, all without a human pulling the trigger. The AEPD called it proof that AI-powered attacks “have ceased to be a theoretical risk.” For developers shipping agents, this is the moment GDPR compliance gets personal.
What the Agent Actually Did #
The attack followed a disciplined, multi-stage chain. The agent obtained valid credentials, authenticated into the target application, then autonomously scanned files for vulnerabilities. It found one, escalated its own access, modified personal data records, and exfiltrated invoice data — all at machine speed. Every phase maps to a real MITRE ATT&CK technique: credential reuse (T1078), active scanning (T1595), application exploitation (T1190), data manipulation (T1565), and exfiltration (T1537). No human directed any of it. The whole sequence ran faster than most detection systems can log a first alert.
The AEPD declined to name the affected organization or disclose which large language model powered the attack. That second omission is deliberate — and important.
The Deployer Owns the Breach, Not the Model Provider #
Spain’s regulator was explicit: “the focus remains on the implementation and the security of the environment in which the agent operated — not on the model itself.” If you deploy an agent that runs amok with personal data, you are the data controller. The model vendor is not. GDPR Article 33’s 72-hour notification clock starts ticking the moment you discover a breach, regardless of whether a human attacker or an autonomous system caused it. Developers who assumed the LLM provider would absorb liability need to rethink that assumption now.
The Rule of Two Is Now the Compliance Baseline #
In February 2026, the AEPD published guidance on agentic AI establishing what security researchers call the “Rule of Two”: no agent should simultaneously process untrusted input, access sensitive data, and take autonomous action without human oversight. The Spain breach violated all three conditions at once. The AEPD has effectively made this the expected baseline, and it is widely anticipated to become the EU DPA audit standard within twelve months.
Run this check against your own stack right now. Does your agent:
- Accept input from untrusted external sources — web content, user uploads, third-party APIs?
- Have read or write access to personal data or sensitive records?
- Execute actions autonomously without a human checkpoint before commit?
If all three are true, you have a Rule of Two violation in production. The Spain incident shows exactly what that looks like when an attacker finds it first.
Old Defenses Do Not Work at Agent Speed #
Spain’s national cybersecurity center (CCN-CERT) noted in June 2026 that “traditional pentesting cadences are inadequate against AI-equipped attackers” and that detection must “operate at machine speed — not merely faster human oversight.” That is the structural problem. A human-run breach gives your team hours to contain it. An agent-run breach — credential theft to data exfiltration — can complete in minutes. Periodic credential audits, weekly vulnerability scans, and next-day alert triage are not security postures anymore. They are compliance theater.
What to Check in Your Agent Stack Today #
The AEPD’s recommendations, combined with analysis from AvePoint and Rescana, reduce to four concrete actions:
- Scope every tool to minimum required access. A KYC pipeline agent that only needs to write one database record has no business with read access to the full table. Audit every tool your agent can invoke. Ask: what is the blast radius if an attacker controls one tool call?
- Monitor agent credentials in real time, not on a schedule. API keys, tokens, and service accounts used by agents must trigger anomaly alerts on the first unusual call — not during the next audit cycle.
- Add human checkpoints before consequential actions. Data deletion, bulk record updates, external API writes — require approval before the agent commits. This alone would have broken the Spain attack chain.
- Log every action, not just outputs. GDPR Article 33 requires you to reconstruct what happened. If your agent logs “task completed” instead of each tool call and the data it touched, your incident response is already behind.
The Regulatory Ratchet Is Tightening #
The EU AI Act’s high-risk provisions now require autonomous agents processing personal data to include a functional human override mechanism (Article 14) and per-decision audit trails (Article 12). Maximum penalties reach €35 million or 7% of global turnover — 75% higher than GDPR’s ceiling. The Spain breach did not happen under the AI Act’s strictest requirements, which are still phasing in. The next incident might. Developers have a shrinking window to get agent architectures right before regulators stop accepting “we didn’t know agents were in scope.”
The AEPD’s verdict is unambiguous: the era of AI-powered autonomous attacks is here, and the liability lands on whoever deployed the agent. Treat the Rule of Two as a minimum bar, not a target. Your agent stack almost certainly needs a security audit this quarter — not next year.