Identity and credential management

Four of the six stages in AEPD's agent-breach report happen after a successful login

Spain's AEPD has not confirmed the sequence, the organization or the agent framework behind the notification it received, and the controls it points builders to were already published in its February 2026 agentic AI guidance.