The AEPD receives the first notification of a cyber attack carried out by an artificial intelligence agent

The Data Protection Agency (AEPD) has received the first notification about a possible cyberattack perpetrated by an autonomous artificial intelligence agent.

In the midst of panic about the scope of this technology and the implications of its uncontrolled development, the AEPD received a notification in which an autonomous agent is accused of illicitly accessing third-party data, causing a data breach.

According to the Agency's account, an attacker would have used this agent to successfully chain together "different attack phases."

"The attacking agent began a search for vulnerabilities in generic files, and logged in correctly. Once he accessed the system, he began to search, autonomously, for vulnerabilities in the application, which, once achieved, allowed him to modify personal data and access invoices," details the public body.

There are no clues about the companies involved or the model used, which is described as a "well-known language model", which makes it likely to be one of the commercial chatbots.

As a result of this incident, the entity has asked for extreme precautions and to review the companies' action protocols, since the use of agents makes it necessary to accelerate response procedures.