Spain records first fully autonomous AI-executed data breach, raising security alarms

Spain's Data Protection Agency has confirmed the country's first data breach carried out entirely by an AI agent, with no human involved at any stage of the attack. The agent independently performed reconnaissance, authenticated, probed the system, and altered data — a step beyond previously documented cases where humans still directed each move. Separately, researchers at Hacktron detailed a related attack chain that exploited a flaw in the libheif image-decoding library, a misconfigured OpenAI SSO, and used Claude Opus 5 to build the exploit. In a third incident, a threat actor dubbed LeakySensey compromised over 87,000 IP addresses via brute-force attacks on PPTP and L2TP devices, automating the operation with a modified AI coding tool and earning over $200,000 since 2024. Security experts note that the common thread across all three cases is not novel sophistication but rather long-standing unpatched vulnerabilities and misconfigurations that AI tools now allow a single operator to exploit at scale.