Spain's Data Protection Agency (AEPD) received notification on 2026-09-15 of a personal-data breach allegedly carried out by an AI agent powered by a known large language model. The incident marks the first reported data breach attributed to an autonomous AI agent in Spain.
Spain's data protection authority documented the first known data breach involving an AI agent, which used a large language model to access a system, modify personal data, and steal invoices. The report was published on September 15, 2026.