In September, Spain's data protection authority, the AEPD, announced it had received its first notification of a personal data breach in which an AI agent that used a well known language model is described as having carried out the attack.
According to the notification, the agent began by searching generic files for weaknesses and logged in successfully. Once inside, it searched the application for vulnerabilities on its own, and when it found one it modified personal data and reached invoices. What matters from a data protection perspective, the AEPD wrote, is that a third party would have used an agent as an instrument to chain the different phases of the attack together successfully.
The AEPD explains why that is a change of kind. Generative models have long helped attackers write phishing messages, translate fraudulent campaigns, impersonate people or analyse code. An agent can take a goal, plan intermediate tasks, use tools, run code, consult sources, interpret the results and change course on its own depending on what it finds. AI adds speed, scale and adaptability to techniques that were already known, and it shortens the time available to detect and contain them.
Two cautions come with the account, both from the AEPD. The information comes from the notification submitted by the affected organisation and still required analysis. Using a particular model is no indication that the model or its provider's infrastructure was compromised, or that the tool was designed for malicious activity. One notification is too few to show a statistical trend, yet the AEPD calls it a significant signal that attacks supported by AI have stopped being a theoretical risk and are starting to appear in incidents involving real personal data.
The AEPD drew four lessons for organisations. Risk analyses should name AI assisted attacks explicitly, because a generic reference to malware or phishing falls short when automation can change the probability, speed and reach of an incident. Response procedures built for manual attacks may be too slow when an agent examines several assets at once, tries different routes in and adapts quickly. Identities and credentials matter more, because an agent holding an account, key or token with excessive permissions works at machine speed and can reach several services before anyone notices. And security needs more than manual intervention: human oversight stays indispensable, but it has to be backed by detection, containment and response that act fast enough.
The fundamentals still decide the outcome: know your processing, minimise data, limit access, fix vulnerabilities, control suppliers and be ready to respond.
That is the attacker's side. The AEPD's guidance on agentic AI, published in February, covers the other side: organisations that use agents themselves. It defines an agent as an AI system that uses language models to achieve a goal, acting according to its circumstances and staying flexible as environments and goals change. In March, Freshfields, one of London's Magic Circle law firms, called it the first detailed regulatory guidance of its kind and noted that no other European supervisory authority had published anything of comparable depth.
The AEPD explains the need for a dedicated document plainly: the main vulnerabilities of agentic AI lie in its power and versatility. Agents interact with their environment and integrate several services at once. They can also behave in ways that do not repeat, since the same input can lead to very different sequences of actions over time, which makes audits and validation fragile. An agent often relies on a chain of external services, such as language model providers and cloud infrastructure, each of which may process personal data, and that raises the question of who is controller and who is processor. The AEPD's starting point is that introducing an agent changes the nature of a processing operation: it can reduce existing risks, increase them or create new ones.
Its risk management section contains a rule that fits on one line. An agent can carry three risk factors: it processes input it cannot trust, it has access to sensitive data, and it can take automatic actions with real effects. The rule of 2 says no more than two of the three should be present at once. The AEPD notes that the rule was first set out in 2021 for browser security and later reformulated for AI agents. It treats it as a minimum threshold of safeguards that must never be crossed, and as a starting point: a general rule focused on cybersecurity, on top of which data protection asks for more, such as input that is complete, coherent, up to date and unbiased.
The logic is easy to follow. Untrusted input can carry instructions someone else wrote, sensitive data is what is worth taking or changing, and automatic action is what turns an instruction into an effect. With all three present, the AEPD says, the configuration should not be allowed. In practice the rule forces a choice about which one to give up, and the AEPD's own example is an agent that answers emails automatically. If an agent can read incoming mail and reach sensitive data, it must not act on its own without human supervision. An agent that can reach sensitive data and act automatically needs guarantees on the integrity and security of the information it works with.
The constraints are real. Giving up one of the three limits what an agent can do, and the guidance adds obligations around it. Because an agent changes the processing, the controller has to run a new risk management cycle, and an existing processing operation needs a compliance review. The data protection officer should take part in designing the safeguards, and the agent's operations should be traceable. Whether a data protection impact assessment is needed depends on the processing and the type of agent; where one already exists, it may need revisiting. Governance should be single: what agents add has to map onto existing governance, or be created where it is missing.
The positive side is just as concrete. The AEPD warns that rejecting agentic AI out of hand can be as harmful as accepting it uncritically, and asks organisations to use it proactively for data protection by design, even as a privacy enhancing technology in its own right. Its examples include small language models in intermediate steps that categorise, clean, minimise and flag data exchanges, and steps where sensitive data is used without being exposed to human operators. Where an agent adds no processing beyond the original one, no new legal basis is needed.
Read together, the two pieces are practical. One shows what an agent can do once it is inside a system. The other shows what an organisation can ask of its own agents before they are deployed. Both end at the same point: limit what an agent can combine, and keep a person able to step in at the speed the agent works.
These are the questions we think about every day. Our private AI environment is dedicated to each organisation and hosted entirely in Europe, with a human expert one click away inside every conversation. We will be at Dubai AI Festival on 26 and 27 October, at the Dubai World Trade Centre, stand S117 in the Startup Zone. If you are deploying agents and want to talk governance, come and find us.