The Attacker Was An Agent

YPO Technology Network AI Brief · Sep 17, 2026 · 10m

Spain's data protection agency has received the first notification of a personal-data breach in which the intruder was an AI agent rather than a person. By the notifying company's account, the agent searched for vulnerabilities, achieved a valid login, explored the application on its own, altered personal data and accessed invoices. The regulator's response is not a new rule but four changes to how every company must think about risk, response time, credentials and human oversight, with its own caveat that AI creates no new threats; it removes the time you had to respond to the old ones.

In…