A valid login can be the beginning of an attack, not evidence that the activity which follows is safe. Spain's data-protection authority has described a breach notification in which an AI agent allegedly searched an application for weaknesses after successful authentication, then accessed invoices and modified personal data.

The AEPD account, published on 14 September, calls this the first notification of this kind received by the authority. It immediately qualifies the evidence: the information comes from the affected organisation's notification and remains subject to analysis. That is not the world's first independently proven autonomous breach.

The authority does not publicly establish the organisation, attacker, specific model or application vulnerability in the reviewed account. It also warns that use of a model does not mean its provider's infrastructure was compromised or the model was designed for malicious activity. One report cannot establish a statistical trend.

The AEPD's broader concern is that agents can chain tasks, use tools and adjust their next step, potentially shortening the defender's response window. A legitimate identity with excessive access is an especially important boundary. The account does not supply a measured attack duration, a proven level of autonomy or a count of affected people, and those gaps should remain gaps.

For a security team, however, proving which model was used should not be a prerequisite for containing suspicious activity. The relevant incident questions are observable: what identity was accepted, what it could reach, which actions followed, what records changed and whether the organisation can revoke that access…