Spanish privacy regulator probes AI agent-driven cyber attack

Spain’s Data Protection Agency has been notified of a cyber attack conducted by an artificial intelligence agent driven by a large language model.

 

In a recent blog post on its website, the Spanish Data Protection Agency (AEPD) reported receiving its first personal data breach notification tied to an autonomous AI agent powered by a known LLM. 

 

A large language model (LLM) is an AI system trained on vast amounts of text to understand and generate human-like language. It uses patterns learned from its training data to predict and generate text, with some models containing billions or even trillions of parameters.

 

According to the AEPD, the reporting organisation said the AI agent initially searched for vulnerabilities in generic files before successfully logging into the system. After gaining access, it autonomously identified vulnerabilities in the application, allowing it to modify personal data and access invoices.

 

The agency said the incident remains under investigation and clarified that the involvement of a specific AI model does not suggest that the model or its provider’s infrastructure was breached, or that the technology was intended for malicious activities.

 

Furthermore, AEPD said that AI has already been used in cyberattacks for phishing, fraud, identity impersonation, code analysis and vulnerability discovery. AI agents take this further by autonomously planning tasks, using tools and adapting their actions based on results. While AI does not introduce entirely new threats, it can make existing attacks faster, more scalable and adaptable, leaving less time for detection and containment.

 

“Procedures designed for manual attacks may prove inadequate when an agent simultaneously analyses multiple assets, tests various access vectors, and rapidly adapts its behaviour,” the agency said, advising organisations to review their response times to similar incidents and adapt to the possibility of malicious actors using AI agents to enhance their chances of success.

 

The agency also called for organisations to combine human oversight with automated detection, containment and response mechanisms to ensure that overall response to cyber attacks are speedy, efficient and keeps pace with the pace at which AI agents operate.