Four of the six stages in AEPD's agent-breach report happen after a successful login

Four of the six stages the affected organization reported happen after the agent was already inside a system ^[19], and the notification does not show it selecting the victim, obtaining the credentials or setting the objective ^[7]. The autonomy on the record starts inside an authenticated session.

Francisco Perez Bes, deputy to AEPD's president, published the agency's account on September 14th ^[5]. He wrote that defensive procedures designed around human-speed attackers may fail when software can inspect assets, try different routes and adjust its approach without waiting for further instructions ^[15].

A model generates or evaluates the next step, while the surrounding framework supplies network access, code execution, stored credentials, application interfaces and permission to read or alter records ^[10]. You set each of those five in the product you ship.

Generative AI was already drafting phishing messages, translating scams, inspecting code and helping search for vulnerabilities ^[11]. AEPD's account puts the operational risk in the chaining of those tasks into one running process ^[12]. The agency said AI can increase the speed, scale and adaptability of established malicious methods, leaving defenders less time to detect and contain them ^[13].

One line in the agency's reasoning has a direct engineering consequence: a monitoring process that alerts a person may arrive too late if the agent can inspect, exploit and modify data between alert cycles ^[17]. That compares two periods, your detection loop and the attacker's step time. Neither is timed in the published account, so this case cannot size the gap.

The controls AEPD points to come from its February 2026 guidance on agentic AI, and there are ten of them: controlling which services agents can reach, restricting tool execution, checkpoints for human intervention, reversible actions, traceability, sandboxing, identity and privilege management, data-flow controls, circuit breakers, and hard limits on the number of steps ^[18][20]. By my count, eight of the ten bound what the agent itself can reach or do, and the other two, checkpoints and traceability, assume a person acts on what they see ^[21].

AEPD's public account is limited to what the affected organization reported, and the notification is still under review ^[2]. For it to change a threat model, the agency would have to confirm the sequence and say what privileges the compromised account held; both are still open, and it has said one case cannot establish a broader pattern ^[3][4]. The guidance does not depend on that verification. It was written for agents organizations deploy on purpose, and each limit in it binds an agent whoever wrote the objective. AI agents still operate under goals, configurations and tool permissions established by people, the agency said, even when the software decides how to break a task into steps ^[8].