First AI-driven cyberattack reported in Spain
Spain's data protection agency AEPD says it has received its first report of a cyberattack in which an AI agent actively carried out part of the attack.
According to the agency, the agent first searched for vulnerabilities in files, logged into a system successfully, and then independently hunted for further weaknesses.
Once it found suitable flaws, the agent was able to alter personal data and access invoices within the system.
The AEPD did not name the affected organization or the AI model used. Known cases so far involved AI agents that are not publicly available.
AEPD deputy director Francisco Pérez Bes said such attacks fundamentally change risk management, mainly because they move far faster than attacks carried out manually by people.
The agency stressed that the incident does not mean an AI provider itself was compromised. It is still urging organizations to explicitly include AI-driven attacks in their risk assessments and to better protect login credentials and system interfaces.
WHY IT MATTERS
The case shows that AI systems can carry out and speed up cyberattacks on their own, pushing traditional defenses to their limits.
WHAT YOU CAN DO NOW
- Use strong, unique passwords Use a different, strong password for every account and store them in a password manager. This stops an AI agent from reusing stolen login data elsewhere.
- Keep software updated Install updates for apps and devices as soon as they appear. Many attacks use known security gaps that updates already fix.
- Turn on two-factor login Add a second login step, like a code from an app or text message, to your important accounts. A stolen password alone then won't be enough to get in.
- Check accounts for odd changes Regularly review your invoices and account activity for anything unfamiliar. Report anything strange to the provider or your bank right away so it can be handled quickly.