ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0538

ACVE-2026-0538

An AI agent used by an attacker logged in to an organisation's application, modified personal data and accessed invoices, in the first such breach notified to Spain's data regulator.

Exposure

Evidence
Real use · researcher report
Harness
An AI agent, not named by the regulator — confirmed, www.aepd.es
Model
A well-known language model; the regulator withholds its name — confirmed, www.aepd.es
Goal
Any attacker-directed task that can use login, discovery and data-access tools (goal not stated by the source) — unconfirmed
Tools and settings
Vulnerability searching across generic files and the application, and a working login to the application; no tools are named — confirmed, www.aepd.es
Approval
The regulator says the agent searched for vulnerabilities autonomously; no approval mode is stated — confirmed, www.aepd.es
Input controlled by
operator
What the agent does
The agent logs in, searches the application for vulnerabilities on its own, and uses them to modify personal data and access invoices.
Harm
data-exfiltration
Reach
Personal data and invoices in the affected organisation's application — confirmed, www.aepd.es (the network)
Condition
After a successful login, when the agent autonomously searched the application for vulnerabilities — confirmed, www.aepd.es
Recovery
Not reported: the regulator does not say whether the modified data was restored or the incident contained. — unconfirmed (unknown)
First-hand sources

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Severity
HIGH · harm and reach
Status
Unverified
Kind
Behavioural
Modified
2026-09-25
Aliases
No CVE assigned — No code defect is established: the report describes an attacker-directed agent operation.
Affected
  • AgentHarness: unnamed-ai-agent — all versions
Harness/product
unnamed-ai-agent
Classes
over-privileged-combination; CWE-693
First reported
2026-09-14 — Francisco Pérez Bes, AEPD
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

The exposure axes marked confirmed were matched to the first-hand sources listed above.

Description

Threat

user · unsafe-default · harmful-action

What

Spain's data-protection regulator, the AEPD, published the first breach notification it has received for an attack carried out through an AI agent that used a well-known language model, which it does not name. According to the affected organisation's notification, a third party used the agent as an instrument to chain the phases of the attack: it searched generic files for vulnerabilities and logged in successfully, then autonomously searched the application for vulnerabilities, which let it modify personal data and access invoices. The AEPD does not name the organisation, does not say how the login was obtained or whether the data was restored, and cautions that using a specific model does not imply the model or its provider was compromised.

Detection

The AEPD says the information comes from the organisation's notification and still has to be analysed. Recorded from the AEPD's post. Not recreated in a lab.

Fix

Protect credentials and digital identities, add rapid detection and containment, and keep high-impact actions under human control.

Fix

The attacker ran the agent, so the controls that protect victims are the targeted organisation's credential protection and fast detection, and the model provider's misuse detection.

  • Reconfigure model-provider.misuseDetection to detects agents attacking third-party applications. Recommended: the attacker chained login, vulnerability search and data changes through one agent. Owner: model-provider
  • Reconfigure application.login to strong credential and identity protection. The targeted organisation's application accepted the agent's login; the AEPD recommends protecting credentials. Owner: operator
  • Reconfigure application.monitoring to fast detection and containment of automated attacks. The agent searched the targeted organisation's application on its own; the AEPD recommends fast detection and containment. Owner: operator

References

ARTICLE

Report a problemJSON