Agents Took 150GB From Nine Mexican Agencies. The EU Deadline Just Slipped to 2027

Attackers used compromised AI agents to extract 150 gigabytes of data from nine Mexican federal agencies between December 2025 and February 2026, including the federal tax authority and the electoral institute, according to Israel Duanis, chief executive of the identity governance vendor Linx Security, writing for the Forbes Tech Council ^{[2] [1]}. That matters less as breach trivia than as a timing problem: the EU AI Act's high-risk compliance obligations, originally set to apply on August 2, 2026, will now take effect in December 2027 ^[4], roughly 16 months later than planned ^[13].

The second incident Duanis cites is a June 2025 zero-click prompt injection in Microsoft 365 Copilot that let a single attacker exfiltrate data from OneDrive and Teams ^[3]. Both are asserted in a sentence each, with no actor named and no account of how the agents were compromised ^{[2] [3]}. Read them as claims from an executive selling into the category ^[1]. The operational argument does not actually rest on them.

That argument is that most enterprises now run three identity layers and govern them as separate programmes ^[11]. Human identity carries the familiar debt: dormant accounts, permissions from five jobs ago, privileged access nobody cleaned up ^[14]. Non-human identities, meaning service accounts, API credentials and container identities, run into the tens of thousands and were mostly never formally provisioned ^[8]. Agents are the third layer, and per Duanis they operate around the clock, spawn sub-agents dynamically, request permissions thousands of times a day, and chain actions across dozens of systems in minutes ^[9]. Only 21% of organisations report a matured programme for governing agents ^[7], which leaves 79% without one ^[15].

The most useful passage is not the breach count. Duanis describes a financial services firm where an agent deployed to research vendor risk accumulated access to procurement systems, vendor databases and internal communications within months; much of that access was never formally provisioned but emerged as the agent embedded itself in daily workflows, and by the time leaders saw the scope, revoking it without breaking operations had become difficult ^[10]. That is not an attack. That is entitlement creep at machine speed, and it happens inside a compliant, audited estate.

The questions Duanis says CISOs cannot answer with current tooling are worth putting to your own team this quarter: which agents hold access to production data, what the blast radius is if one is compromised, whether an agent's access actually expired when its project ended, and whether it can be revoked instantly if behaviour changes ^[16]. His prescription is a separate governance framework for agents rather than forcing them into human-centric workflows, unified visibility across all three identity types in one view, and automated revocation on detection ^[12]. Note that this is also a description of his product ^[1]. The first two items are cheap to attempt and will tell you how bad the inventory problem is before anyone buys anything.

Watch three things. Whether December 2027 holds as the AI Act date, or moves again ^[4]. What NIST publishes as standards for autonomous agents, since that is likely to shape procurement language before any statute bites ^[6]. And what the SEC does as it tightens rules around AI-driven decision-making ^[5], which reaches the disclosure side of the house, not just security.