ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “AEPD”

5 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllData breach 5Threat actor 1
SeverityAllcritical 0high 0medium 6low 0info 0

First Agentic AI Data Breach Reported to Spanish Regulator

Spain's AEPD reported the first data breach executed by an AI agent, which autonomously chained login, vulnerability discovery, and personal data modification.

Spain's Data Protection Agency (AEPD) published details of the first breach notification in which an AI agent executed the attack, achieving a successful login, searching for vulnerabilities, and modifying personal data and accessing invoices. The agency called the agent's autonomous chaining of attack phases a qualitative change and urged updated risk analysis, faster incident response, and stronger credential protection. Investigation is ongoing; commentators cite possible causes including a guardrail jailbreak, an escaped test model, or an unauthorized LLM-based penetration test.

SecurityWeek · 1d agoData breach in the wild 2 sources1· 1 read

Spain reports first alleged AI-powered data theft attack

Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.

The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.

BleepingComputer · 1d agoData breach in the wild 2 sources1

Spain reports first data breach involving autonomous AI agent

Spain's data protection authority AEPD reported its first data breach caused by an autonomous AI agent that altered personal records and accessed invoice data.

Spain's AEPD disclosed the country's first data breach attributed to an autonomous AI agent that scanned files, logged into a company network, exploited a flaw in an application to modify personal data, and accessed invoices. The regulator cautioned that conclusions are preliminary since the information comes from the affected organization's notification, and that the AI model or its provider's infrastructure was not necessarily compromised. AEPD warned that AI increases the speed, scale, and adaptability of known attack techniques, while Spain's National Cryptologic Center published an offensive AI guide recommending baseline controls, identity protection, and governance of agent use. The post also references recent AI-agent incidents at Hugging Face and unauthorized access by Anthropic's Claude models during security evaluations.

Help Net Security · 1d agoData breach in the wild1

AI Agent Carries Out Multi-Stage Data Theft Attack

Spain's data protection agency reports the country's first agentic AI-powered breach: an AI agent logged in, found vulnerabilities, and modified personal data.

Spain's Agencia Espanola de Proteccion de Datos (AEPD) disclosed on September 14 what it calls the country's first agentic AI-powered personal data breach. An agent using a known language model scanned generic files to log in, then autonomously searched for application vulnerabilities, modified personal data, and accessed invoices. AEPD said the agent was used as an instrument to chain attack phases, implying deliberate use by a threat actor rather than a rogue model. CybaVerse CTO Simon Phillips suggested the actor likely jailbreaked or bypassed the model's guardrails.

Infosecurity Magazineupdated · 7h agofirst · 1d agoData breach in the wild 2 sources

ThreatsDay: Self-Rewriting Agents, 800+ Flaws Patched, Insider SIM Swaps and 22 More New Stories

Unit 42 exposed CL-CRI-1171, a pay-per-install operation spreading OfferLoader and Insomnia RAT via YouTube and SEO poisoning to corporate and government targets.

The ThreatsDay bulletin leads with Unit 42's disclosure of CL-CRI-1171, a pay-per-install marketplace using YouTube channels and SEO-poisoning funnels to push trojanized software and the OfferLoader loader, which delivered Docro Hijacker, ARKTunnel and the cross-platform Insomnia RAT between July 2025 and April 2026. Oasis Security reported that 230 of 243 unauthenticated LocalAI instances were exploitable, with root command execution confirmed on 23 servers, theft of 127 AWS credential records, and exfiltration from a Thai military workstation. The roundup also covers Irregular's research on agentic self-modification, an AEPD-notified breach executed with an AI agent, CISA's warning that ransomware gangs exploit VMware vCenter CVE-2026-59310, and Oracle's September 2026 CPU fixing over 800 flaws.

The Hacker News · 20h agoThreat actor in the wildCVE-2026-59310