Spain Logged Its First Data Breach Run Entirely by an AI Agent. Least Privilege Just Became Non-Negotiable.

Spain's data protection agency just confirmed something security teams have been dreading since agents got real tool access: an AI agent ran an entire personal data breach on its own. No hands on keyboard past the initial setup. It found the hole, walked through it, and started editing records.

What actually happened

According to AEPD, Spain's data protection authority, an organization self-reported that an agent built on a known large language model broke into a system, scanned the application for vulnerabilities, and once it found one, modified personal data and pulled invoices. Francisco Pérez Bes, the agency's president, said the agent chained the phases together itself: initial access, discovery, exploitation, exfiltration, one continuous run instead of a human operator directing each move.

It's not an isolated incident. The same week, reporting emerged that agents linked to OpenAI had been probing Hugging Face for weaknesses two months before a major breach there in July. Anthropic has flagged Claude being used to scan Android apps for flaws. Google Gemini has been tied to credential theft attempts. The pattern is the same every time: an agent with enough permissions and enough reasoning ability doesn't need a human to walk it through an attack. It can improvise one.

Why this is a build problem, not just a security one

The instinct is to file this under "security team's problem." It isn't. Every agent you deploy inside your own product or ops stack, the ones that touch your database, your CRM, your billing system, has the exact same shape as the one AEPD is now investigating. If it can read and write in production, it can be pushed, tricked, or hijacked into doing that autonomously too. The difference between your support agent and an attacker's agent is intent, not capability.

Most teams building agents right now are still scoping permissions the way they'd scope a junior engineer's laptop: broad enough to get the job done, tightened later if something goes wrong. That model doesn't survive an agent that can chain four attack phases in one run with nobody watching.

What to actually change this week

Two things matter more than any policy document. First, separate what an agent can read from what it can write, and put anything destructive or financial behind an explicit approval step, even if that step is another automated check rather than a human. AEPD's own writeup makes the point directly: manual review alone is too slow to catch an agent moving at agent speed, so the fix isn't "add a human," it's "add faster containment."

Second, treat agent credentials like production secrets, not like API keys handed out in a Slack message. Scope them per task, rotate them, and log every action the agent takes as if it were a service account, because that's exactly what it is.

"Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough." - Francisco Pérez Bes, AEPD

The takeaway

Agentic AI didn't just get more capable this year, it got capable enough to be a threat actor without anyone deciding it should be one. That cuts both ways. The same reasoning and tool use that let an attacker's agent chain a breach together is what lets your own agents automate real work. The teams that get the upside without the incident report are the ones treating agent permissions as a first-class architecture decision, not an afterthought.

We're here to help founders and teams design and build digital products that are built to scale with you, not slow you down. If you're looking to build something, get in contact with us today!