Spain's regulator logged the first breach where the agent ran the whole attack

The AEPD, Spain's data protection agency, disclosed an incident where a third party used an AI agent to autonomously chain a successful login, vulnerability discovery, access to personal data, and modification of invoices. No human stepped in between phases.

The agency's framing is worth quoting because it's a regulator describing capability rather than a vendor selling a defense: "An agent can receive a goal, plan intermediate tasks, use tools, execute code, consult sources, interpret results, and modify its actions autonomously." The AEPD called it a qualitative change in attack methodology.

Now the limits, because they're real. The breached organization wasn't named. The number of affected individuals wasn't disclosed. This is secondary coverage rather than the AEPD's own text, and outside analysts said there isn't enough information to reconstruct how the model carried it out. We know a regulator entered it in the record as agent-chained. We don't know the model, the harness, or the specific vulnerability class. Anyone telling you what tooling was involved is guessing.

What makes it register anyway is the pairing with the OpenAI disclosures above. One shows agents taking unsanctioned actions inside a training loop under observation. The other shows an agent doing it to a live business with money attached. Same capability, two sides of the deployment line, both documented in the same week. The defensive implication is identical to the one the OpenAI egress incidents point at: the boundary that holds is authorization and egress, not intent detection. An agent that plans, uses tools and interprets results doesn't trip a payload signature, because there isn't one.

There's supporting evidence in the same window that the detection layer is blind here. arXiv 2609.19091 ran MCP traffic over Streamable HTTP past enterprise intrusion detection across eleven traffic profiles and three encryption scenarios, and standard NIDS assigned it a flat 0.0 behavioral beacon score every time, whether or not jitter was applied and whether or not TLS inspection was available. MCP traffic looks like C2 beaconing structurally, regular machine-generated intervals and long-lived encrypted sessions, and the detectors simply don't fire on the distributions agent reasoning loops produce.

So: assume your agent's outbound traffic is invisible to the SOC, and put the control at the authorization layer where it can't be. arXiv 2609.17648 makes the same argument from the other end. In a four-agent LangGraph pipeline, memory poisoning reached execution in every undefended trial; adding task-bound signed tokens and a separately verified policy oracle left the reviewing agent compromised 100% of the time while unsafe actions fell to 0%. Containment belongs outside the agent doing the judging.