Agencia Española de Protección de Datos (AEPD)

In a blog post titled as the first such notification it has received, Spain's data protection agency (AEPD) says it received a personal-data breach notification in which the incident would have been carried out by an AI agent using a known language model, without naming the model. Per the notification, the agent searched generic files for weaknesses, logged in, searched the application for flaws on its own, then modified personal data and accessed invoices. The AEPD stresses that this comes from the affected organization's notification and will require analysis, that the model's use does not mean the model or its provider was compromised, and that one notification shows no statistical trend, and it advises including AI-assisted or AI-executed attacks in risk analyses and revising response times.