InfoSec News Nuggets – 09/17/2026

Spain Gets Its First Taste of AI-Aided Cyber Attack

Spain’s data protection agency, the AEPD, has logged the country’s first personal data breach attributed to an autonomous AI agent, with the agency’s president confirming an individual deployed an agent built on a known large language model to carry out a multi-stage attack against an organization.

The agent scanned generic files, logged into the target’s systems, ran vulnerability scans to find flaws granting read/write access to files containing personal data, then modified records and accessed invoices — chaining together multiple attack phases with minimal human steering at each step.