AI Agents Are Now Breaking Into Business Systems: Cybersecurity Just Changed
A hacker no longer necessarily needs to sit in front of a screen for hours searching for a way into a company's systems.
Software can increasingly do parts of that work itself.
Find a weakness.
Attempt access.
Explore what is behind the login.
Look for another vulnerability.
Change data.
Open financial documents.
And adapt its next action according to what it discovers.
That is the uncomfortable lesson emerging from a new cybersecurity incident disclosed by Spain's Data Protection Agency, the AEPD.
On September 14, 2026, the regulator said it had received its first notification of a personal-data breach allegedly executed using an artificial intelligence agent.
According to the report submitted by the affected organization, the agent used a well-known language model, searched for vulnerabilities, obtained access to a system, continued probing the application and ultimately gained the ability to modify personal data and access invoices.
The AEPD has been careful not to present those claims as a completed forensic finding. The information came from the affected organization and remains subject to further analysis.
That distinction matters.
But so does the larger warning.
The age of the AI-assisted hacker is rapidly evolving toward something more powerful:
The autonomous cyber agent.
This Is Not Just ChatGPT Writing a Phishing Email
Artificial intelligence has been used in cybercrime for years.
Attackers can use generative AI to write convincing phishing messages, translate scams, generate malicious code, research targets or automate repetitive tasks.
Those uses still largely resemble a human operating a tool.
Agentic AI changes the relationship.
An AI agent can be given an objective and allowed to perform multiple steps toward completing it.
Instead of asking:
"Write me code that checks this server."
someone might eventually give an agent a much broader goal:
"Find a way into this environment."
The agent can potentially decide which intermediate actions are required.
It may call tools.
Execute code.
Read results.
Change strategy.
Interact with websites or APIs.
And repeat the process.
The important development is not simply that AI has become more intelligent.
It is that AI is increasingly gaining agency.
And in cybersecurity, agency can be far more consequential than conversation.
What Reportedly Happened in Spain?
The organization that notified Spain's regulator reported a sequence that sounds remarkably similar to the workflow of a human penetration tester or attacker.
The AI agent initially searched for vulnerabilities.
It successfully logged into the system.
Once inside, it reportedly continued looking autonomously for vulnerabilities in the application.
After finding weaknesses, it was able to modify personal information and access invoices.
Reuters reported that the regulator said the use of a particular language model does not imply that the model itself or the provider's infrastructure had been compromised, nor that the technology was designed for malicious use.
That distinction is essential.
A powerful general-purpose technology can be misused without the technology provider itself being breached.
The investigation is also ongoing, so it would be premature to describe this as definitive evidence that autonomous AI has suddenly replaced human hackers.
But it demonstrates something important.
A threat that security teams have been discussing theoretically is beginning to appear in real breach reporting.
The Real Danger Is Speed
A skilled human attacker can be extremely dangerous.
But humans have limits.
They sleep.
They become distracted.
They can only examine so many systems simultaneously.
They need time to interpret results and decide what to do next.
Software operates differently.
An autonomous system may be capable of repeating processes continuously and at machine speed.
That changes one of the most important variables in cybersecurity:
time.
For years, security teams have tried to reduce metrics such as:
time to detect an intrusion,
time to investigate it,
time to contain it,
and time to recover.
Agentic attacks put pressure on every one of those measurements.
If an automated attacker can move from reconnaissance to exploitation to data access in minutes rather than hours or days, a security operation designed around human-paced incidents may simply respond too slowly.
The defensive question therefore becomes uncomfortable:
Can humans manually defend an organization against attackers operating at machine speed?
Increasingly, security vendors believe the answer will involve AI on both sides.
AI Agents Are Becoming Cyber Defenders Too
Just one day after the AEPD's September 14 disclosure, Cisco announced a major set of new capabilities around Splunk and agentic security operations.
Cisco said its latest Splunk tools are designed to support what the industry increasingly calls an agentic SOC—a security operations center where specialized AI agents assist with functions such as threat hunting, detection engineering, investigation, response and governance.
The company also announced an expanded collaboration with AWS aimed at developing security capabilities able to respond to AI-driven attacks more quickly.
Cisco's argument is straightforward:
If attackers increasingly automate reconnaissance and exploitation, defenders need automation capable of operating at comparable speed.
This could produce one of the defining technology races of the next decade.
AI attacking infrastructure.
Versus:
AI defending infrastructure.
Humans would remain responsible for policy, accountability, risk decisions and critical approvals, but much of the actual digital conflict could increasingly happen between autonomous systems.
Your Next Employee Might Not Be Human
There is another reason companies need to pay attention.
The security problem is not limited to malicious agents outside the organization.
Businesses are rapidly creating legitimate AI agents inside their own networks.
An employee traditionally has a digital identity.
They receive:
an email account,
cloud access,
permissions,
application credentials,
database access,
and perhaps financial-system privileges.
Security teams know how to manage these human identities.
They hire the employee.
Assign permissions.
Monitor activity.
And disable the account when the employee leaves.
Now imagine a company operating hundreds—or eventually thousands—of AI agents.
One agent reads customer emails.
Another creates invoices.
Another generates software.
Another interacts with cloud infrastructure.
Another analyzes financial reports.
Another talks to suppliers.
Another handles customer refunds.
Each agent may need access to applications and data.
In cybersecurity terms, these agents become a new population of machine identities.
And every identity can become an attack surface.
The Password May No Longer Be the Biggest Prize
Modern cloud systems increasingly rely on digital tokens.
A token can tell an application who or what is requesting access and what that identity is allowed to do.
Tokens are fundamental to technologies such as:
single sign-on, cloud services, APIs, workload identities and zero-trust architectures.
On September 15, 2026, the U.S. National Institute of Standards and Technology, working with CISA, finalized NIST IR 8587, guidance specifically focused on protecting identity tokens and assertions from theft, forgery and misuse.
NIST notes that stolen or forged tokens can allow attackers to impersonate authorized users or workloads.
Its updated guidance also includes considerations related to AI and machine workloads and emphasizes approaches such as secure key management, token verification, lifecycle management and short-lived tokens for workload identities.
This may sound deeply technical.
But the business implication is simple.
Yesterday's attacker wanted your password.
Tomorrow's attacker may want the credentials, token or permissions belonging to your AI agent.
And the organization may have hundreds of them.
Why Excessive Permissions Become Dangerous
Imagine an AI assistant whose only job is to prepare a weekly sales report.
It needs permission to read sales data.
Fine.
But during deployment, somebody gives it broad database access because configuring granular permissions takes additional work.
Now the agent can:
read customer records,
modify transactions,
download sensitive information,
or access systems completely unrelated to its job.
Nothing goes wrong initially.
Months later, the agent is compromised or manipulated.
The attacker now inherits whatever access the agent already possesses.
This is why one of cybersecurity's oldest principles becomes even more important in an AI-agent world:
least privilege.
Every person, application and AI agent should receive only the permissions required to perform its legitimate task.
Nothing more.
AI Creates a New Version of Shadow IT
Businesses spent years trying to control shadow IT—software employees adopted without formal approval from their IT departments.
Then came shadow cloud.
Then shadow SaaS.
Now companies face shadow AI.
Employees can connect AI tools to:
documents,
email,
source code,
databases,
customer records,
cloud storage,
CRM platforms,
and internal APIs.
The risk rises significantly once those systems stop merely reading information and begin taking actions.
There is an enormous difference between:
"Summarize these invoices."
and:
"Review these invoices and automatically pay the valid ones."
The first is largely analytical.
The second gives software operational authority over money.
The same distinction applies to deleting files, creating accounts, changing permissions, sending communications and modifying databases.
Autonomy must therefore be treated as a security control.
Human Approval May Become a Premium Security Feature
Spain's AEPD has separately published guidance on agentic AI recommending that organizations establish human-intervention checkpoints before sensitive actions.
Examples include modifying sensitive data, making payments, using credentials for critical activities or carrying out irreversible actions.
The regulator also recommends controls around the tools agents invoke and the parameters sent to those tools.
This leads to a practical principle for businesses adopting AI agents:
Not every task deserves full autonomy.
An AI system might safely:
categorize an email,
summarize a report,
or suggest a response.
But actions such as:
transferring money,
deleting production data,
changing user permissions,
publishing legal documents,
or exposing confidential information
may warrant explicit human approval.
The most sophisticated AI system is not necessarily the one given unlimited freedom.
It may be the one whose freedom is intelligently constrained.
Companies Will Need to Monitor AI Employees
Traditional security software monitors computers, users, networks and applications.
Now organizations also need to understand what their AI agents are doing.
That creates a new category of enterprise observability.
Companies may need answers to questions such as:
Which agent accessed this database?
Why did it call this API?
What information did it send outside the organization?
What action did it perform?
Which model made the decision?
How much did it cost?
Did its behavior suddenly change?
Could the action be reversed?
Cisco's newly announced Splunk capabilities illustrate where this market is heading. The company says its Agent Observability tools can track agent performance and AI token spending while applying runtime controls intended to block unsafe behavior or sensitive-data leakage.
Cybersecurity is therefore expanding beyond protecting computers.
Organizations increasingly need to protect—and monitor—the autonomous software working inside those computers.
Cyber Insurance Could Eventually Change Too
Cyber insurance has already forced organizations to answer difficult questions about their controls.
Do you use multifactor authentication?
Do you maintain backups?
Can administrators access systems remotely?
Do you have endpoint protection?
How quickly can you respond to ransomware?
AI agents could add an entirely new section to those questionnaires.
Insurers may increasingly want to know:
How many autonomous agents does the organization operate?
What systems can they access?
Are agent credentials separated from human accounts?
Can an agent execute financial transactions?
Are actions logged?
Is there human approval for high-risk operations?
Can permissions be revoked instantly?
Are AI activities included in incident-response plans?
This is not merely a technology issue.
Once autonomous agents can make consequential business decisions, their behavior becomes part of enterprise risk.
That means CISOs will not be the only executives paying attention.
CFOs, insurers, auditors, legal teams, compliance officers and boards will have reasons to care as well.
Five Controls Businesses Should Be Thinking About Now
Organizations do not need to ban AI agents.
But deploying them without a security model would be reckless.
A sensible starting point is straightforward.
1. Give every agent its own identity
Do not allow autonomous systems to casually share administrator or employee credentials.
2. Apply least privilege
An accounting agent does not need access to source-code repositories. A coding agent does not automatically need access to payroll.
3. Use short-lived credentials
Persistent secrets create opportunities for long-term abuse if stolen. NIST's latest guidance specifically emphasizes short-lived tokens for workload identities.
4. Require approval for high-impact actions
Payments, account creation, privilege changes, deletion and sensitive data modifications deserve stronger controls.
5. Log everything
If an autonomous system makes a decision at 3:14 a.m., the organization must be able to reconstruct what it did, what information it used and which systems it touched.
These controls are not futuristic.
They are extensions of security principles enterprises already understand.
AI simply makes them more urgent.
The Cybersecurity Industry Is About to Get Much Bigger
The move toward agentic computing creates both risk and an enormous commercial market.
Every company deploying autonomous AI will need some combination of:
identity and access management,
cloud security,
endpoint protection,
SIEM and security analytics,
data-loss prevention,
AI governance,
API security,
zero-trust controls,
observability,
incident response,
cyber insurance,
and potentially entirely new forms of AI-agent security.
That is why some of the largest technology vendors are moving quickly.
Cisco and Splunk are building agentic security operations.
NIST and CISA are updating identity guidance.
Google has introduced programs applying advanced AI to defensive cybersecurity.
Security companies are racing to protect the AI infrastructure enterprises are only beginning to deploy.
We are watching the creation of a new security layer in real time.
The Hacker May Soon Be Software
The most important lesson from Spain's reported incident is not that AI suddenly became evil.
It did not.
Nor does one reported breach prove that autonomous agents are about to overwhelm the internet.
The AEPD itself has been careful to say the reported facts still require analysis.
The important development is more subtle.
AI systems are gaining the ability to act.
And once software can independently interact with digital infrastructure, cybersecurity changes.
An AI agent can be useful.
It can also be compromised.
Manipulated.
Over-permissioned.
Misconfigured.
Or deliberately weaponized.
Businesses spent decades learning how to secure human users, servers, laptops and cloud applications.
Now they have another entity to secure.
One that may work continuously.
Move faster than a human.
Use dozens of tools.
And make thousands of decisions before anyone notices.
The next cybersecurity battle may therefore not be fought simply between a hacker and a security analyst.
It could increasingly be fought between their agents.
And that era appears to be beginning now.
AI agent cyberattack, AI cybersecurity, agentic AI security, enterprise cybersecurity, cloud security, identity access management, IAM security, AI agents, autonomous cyberattack, cyber security 2026, data breach 2026, zero trust security, AI agent identity, cloud identity security, cyber insurance, security operations center, agentic SOC, Splunk AI security, NIST identity security
enterprise cybersecurity solutions, cloud security platform, identity and access management software, zero trust security, AI security platform, managed security services, SOC automation, data breach protection, cyber risk management, cyber insurance for business, cloud identity protection, API security
The hacker doesn't have to stay at the keyboard anymore.
Spain's data regulator has received its first breach notification involving an AI agent that allegedly searched for vulnerabilities, gained access, continued probing a system and reached personal and financial data.
The bigger story isn't one breach.
It's what happens when attackers—and defenders—both begin operating at machine speed.
Reader Question
If your company hired 500 AI agents tomorrow, would your security team know exactly what each one was allowed to do?