The Spanish Data Protection Agency (AEPD) has publicly confirmed what many of us in incident response have been warning about for two years: Spain's first data breach in which an AI agent autonomously carried out a multi-stage data theft attack. This is not a proof-of-concept from a research lab or a vendor marketing slide — it is a confirmed, regulator-disclosed incident in which an autonomous or semi-autonomous AI-driven process progressed through multiple attack stages and exfiltrated data from a real organization.
This matters for three reasons. First, it marks the transition of agentic AI from an offensive hypothesis to an operational observed threat in the European regulatory record. Second, multi-stage autonomous attacks compress the defender's window from hours to minutes — an agent does not sleep, does not make typos, and does not get tired between the reconnaissance and exfiltration stages. Third, because AEPD is a GDPR supervisory authority, this disclosure carries compliance consequences: organizations operating in the EU must now assume regulators will ask pointed questions about AI-agent exposure during breach investigations.
No CVE is associated with this incident — this is a technique-level threat, not a patchable vulnerability. That makes detection engineering and architectural controls your primary defense.
Technical Analysis
What We Know
Based on the AEPD disclosure reported by Infosecurity Magazine, the incident involved an AI agent executing a multi-stage attack chain culminating in data theft. While full technical indicators have not been released, multi-stage agentic attacks consistently follow a recognizable kill chain that defenders can instrument against:
- Initial access / invocation — the agent is either planted by an attacker (malicious agent deployment), hijacked (compromised legitimate agent framework, prompt injection against an internet-facing LLM application), or spawned from compromised credentials against an AI orchestration platform.
- Autonomous reconnaissance — the agent enumerates the environment using whatever tools it can reach: shell access, API clients, database connectors, or Model Context Protocol (MCP) tool servers.
- Privilege and access expansion — exploitation of over-permissioned service accounts, hardcoded API keys in agent configuration, or tool descriptions that grant far more access than the agent's business function requires.
- Data discovery and staging — identification of high-value stores (customer PII, databases, document shares) and aggregation into staging locations, frequently compressed archives.
- Exfiltration — outbound transfer over HTTPS to attacker-controlled infrastructure, paste/file-sharing services, or cloud storage, often throttled to blend with legitimate API traffic.
Why Agentic Attacks Break Traditional Defenses
- Speed: Stage transitions occur in seconds. A SOC workflow keyed to human-speed attacker dwell time will miss the entire intrusion.
- Living-off-the-land tooling: Agents typically invoke legitimate runtimes (
python.exe,node.exe), standard libraries, and sanctioned API tokens. There is often no malware hash to block. - Identity ambiguity: The agent acts under a service principal or service account. If your detections assume service accounts "don't run shells," the agent's activity looks exactly like the gap you never monitored.
- Egress blending: Exfiltration rides port 443 alongside legitimate LLM API calls to OpenAI, Anthropic, or Azure endpoints.
Affected Products, Versions, and Platforms
This is not a product vulnerability — no vendor advisory or CVE applies. The exposure class includes:
- Custom LLM agent deployments (LangChain, LlamaIndex, AutoGen, CrewAI-style frameworks) with tool/shell access
- MCP (Model Context Protocol) tool servers with excessive permissions
- Internet-facing LLM applications vulnerable to prompt injection leading to tool abuse
- CI/CD and automation platforms where AI coding assistants hold credentials
Exploitation Status
- Confirmed real-world incident: disclosed by AEPD as Spain's first AI-powered data breach.
- CVE / CISA KEV: None — technique-level threat.
- Public PoC: Not applicable; however, agentic attack tooling and prompt-injection frameworks are widely available and mature.
Treat this as an active, present-day threat class, not an emerging one.
Detection & Response
The detections below target the observable behaviors of the agentic kill chain: agent runtimes spawning reconnaissance commands, autonomous data staging, and anomalous egress from AI/service workloads. They are deliberately scoped to minimize noise.
Sigma Rules
---
title: AI Agent Runtime Spawning Reconnaissance or Shell Commands
id: 3f8a1b72-6c4d-4e9a-b2f1-9d7c5e3a8f01
status: experimental
description: Detects Python or Node.js agent runtimes (common LLM agent hosts) spawning shell or system reconnaissance commands, consistent with an autonomous agent exploring a compromised environment.
references:
- https://www.infosecurity-magazine.com/news/ai-agent-carries-out-multistage/
- https://attack.mitre.org/techniques/T1059/
- https://atlas.mitre.org/techniques/AML.T0051
author: Security Arsenal
date: 2026/02/10
tags:
- attack.execution
- attack.discovery
- attack.t1059.006
- attack.t1033
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\python.exe'
- '\python3.exe'
- '\node.exe'
- '\pythonw.exe'
selection_command:
CommandLine|contains:
- 'whoami'
- 'net user'
- 'net group'
- 'ipconfig /all'
- 'systeminfo'
- 'nltest'
- 'arp -a'
- 'tasklist'
- 'wmic'
- 'Get-LocalUser'
- 'Get-NetIPAddress'
- 'Get-ADUser'
condition: selection_parent and selection_command
falsepositives:
- Legitimate automation frameworks performing inventory tasks (validate against approved agent inventories)
- Developer workstations running local agent experiments
level: high
---
title: Data Staging via Compression Tools Under Service or Agent Context
id: 8c2e4d91-3b7a-4f5c-a1e6-2d9b8c4f7a12
status: experimental
description: Detects archive creation targeting user data directories, database exports, or document stores — the staging phase of a multi-stage theft executed by an autonomous agent.
references:
- https://www.infosecurity-magazine.com/news/ai-agent-carries-out-multistage/
- https://attack.mitre.org/techniques/T1560/001/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.collection
- attack.t1560.001
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\tar.exe'
selection_target:
CommandLine|contains:
- '\Users\'
- '\Documents'
- '.sql'
- '.db'
- '.sqlite'
- 'dump'
- 'backup'
- '.pst'
- '\shares\'
- 'a -t'
condition: selection_tool and selection_target
falsepositives:
- Scheduled backup jobs (exclude known backup service accounts and paths)
- IT archiving operations
level: medium
---
title: Scripting Runtime Egress to File-Sharing or Paste Services
id: 5d1f7a34-9c6b-4e2d-b8a3-7f4c2e9d1b05
status: experimental
description: Detects Python, Node, or curl processes establishing outbound connections to commonly abused exfiltration endpoints (paste sites, file transfer services, webhook collectors) — a hallmark of agent-driven data theft blending into HTTPS egress.
references:
- https://www.infosecurity-magazine.com/news/ai-agent-carries-out-multistage/
- https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: network_connection
product: windows
detection:
selection_image:
Image|endswith:
- '\python.exe'
- '\python3.exe'
- '\node.exe'
- '\curl.exe'
selection_domain:
DestinationHostname|contains:
- 'transfer.sh'
- 'file.io'
- 'pastebin.com'
- 'paste.ee'
- 'webhook.site'
- 'requestbin'
- 'ngrok.io'
- 'ngrok-free.app'
- '0x0.st'
- 'anonfiles'
condition: selection_image and selection_domain
falsepositives:
- Developers using paste services for debugging (rare on servers; scope this rule to server/agent hosts)
level: high
KQL — Microsoft Sentinel / Defender
This query hunts the full agentic chain: agent runtimes spawning shells or discovery commands, correlated with high-volume egress from the same device. It is scoped to servers and automation hosts where Python/Node should behave predictably.
let agentRuntimes = dynamic(["python.exe", "python3.exe", "pythonw.exe", "node.exe", "curl.exe"]);
let reconCommands = dynamic(["whoami", "net user", "net group", "systeminfo", "ipconfig /all", "nltest", "Get-ADUser", "Get-LocalUser", "tasklist", "wmic"]);
let suspiciousProc = DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where ProcessCommandLine has_any (reconCommands)
or FileName in~ ("7z.exe", "7za.exe", "rar.exe")
| project DeviceId, DeviceName, ProcTime=TimeGenerated, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
let heavyEgress = DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ (agentRuntimes)
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize EgressConnections=count(), DistinctDestinations=dcount(RemoteUrl), Destinations=make_set(RemoteUrl, 20) by DeviceId, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where EgressConnections > 200 or DistinctDestinations > 15;
suspiciousProc
| join kind=inner (heavyEgress) on DeviceId
| project DeviceName, ProcTime, FileName, ProcessCommandLine, AccountName, EgressConnections, DistinctDestinations, Destinations
| order by ProcTime desc
Tune thresholds (EgressConnections > 200, DistinctDestinations > 15) to your baseline — legitimate LLM workloads hammer a small set of API endpoints, so a diverse destination set from an agent runtime is the strongest signal.
Velociraptor VQL
This artifact hunts live for agent runtimes with active external network connections and suspicious command lines — useful during triage of a suspected agent compromise.
-- Hunt: AI agent runtimes (Python/Node) with suspicious command lines and external connections
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node|curl'
AND (
CommandLine =~ '(?i)whoami|net user|systeminfo|nltest|requests|boto3|exfil|base64'
OR Exe =~ '(?i)temp|appdata|programdata|/tmp|/dev/shm'
)
-- Correlate: network connections held by scripting runtimes
SELECT Pid, Name, Path, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ '(?i)python|node'
AND Status =~ 'ESTABLISHED'
AND NOT Raddr.IP =~ '^(10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|127\.)'
Remediation / Audit Script
Run this on Windows servers hosting AI workloads to enumerate agent runtime activity, suspicious archives, and agent configuration that may contain embedded credentials. It is audit-only — it changes nothing — so it is safe to run broadly during triage.
# Security Arsenal - Agentic AI Triage Audit (read-only)
# Run elevated. Outputs findings to C:\Windows\Temp\AgentAudit_<hostname>_<date>.txt
$report = "C:\Windows\Temp\AgentAudit_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd_HHmm).txt"
"=== Agentic AI Triage Audit - $env:COMPUTERNAME - $(Get-Date) ===" | Out-File $report
# 1. Running agent runtimes and their command lines
"`n--- [1] Python/Node processes and command lines ---" | Out-File $report -Append
Get-CimInstance Win32_Process | Where-Object {
$_.Name -match 'python|node'
} | Select-Object ProcessId, ParentProcessId, Name, CommandLine |
Format-List | Out-File $report -Append
# 2. Agent runtimes with established external connections
"`n--- [2] Scripting runtimes with external ESTABLISHED connections ---" | Out-File $report -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
$p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
if ($p -and $p.ProcessName -match 'python|node' -and
$_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|::1|fe80)') {
[PSCustomObject]@{
Process = $p.ProcessName; PID = $_.OwningProcess
RemoteIP = $_.RemoteAddress; RemotePort = $_.RemotePort
}
}
} | Format-Table -AutoSize | Out-File $report -Append
# 3. Recently created archives in staging locations (last 7 days, >10MB)
"`n--- [3] Recent large archives in staging directories ---" | Out-File $report -Append
$paths = @("C:\Temp","C:\Windows\Temp","$env:ProgramData","C:\Users")
foreach ($path in $paths) {
Get-ChildItem -Path $path -Recurse -Include *.zip,*.7z,*.rar,*.tar,*.gz `
-ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 10MB } |
Select-Object FullName, Length, LastWriteTime | Format-List |
Out-File $report -Append
}
# 4. Agent / MCP configuration files that may embed API keys or tool permissions
"`n--- [4] Agent and MCP configuration files (review for embedded secrets) ---" | Out-File $report -Append
Get-ChildItem -Path "C:\Users","C:\ProgramData","C:\opt","C:\srv" -Recurse -Depth 4 `
-Include *.env,mcp.json,claude_desktop_config.json,agents.yaml,tools.yaml,*.toml `
-ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime |
Format-Table -AutoSize | Out-File $report -Append
# 5. Scheduled tasks and services running as agent runtimes (persistence check)
"`n--- [5] Persistence: tasks/services invoking python/node ---" | Out-File $report -Append
Get-ScheduledTask | Where-Object {
$_.Actions.Execute -match 'python|node'
} | Select-Object TaskName, TaskPath, State | Format-Table -AutoSize | Out-File $report -Append
Write-Host "Audit complete: $report"
Remediation
There is no patch for this threat — defense is architectural and operational. Prioritize the following:
Immediate (24–72 hours):
- Inventory every AI agent and MCP server in your environment. You cannot defend agents you do not know exist. Pull the list from EDR process data (Python/Node with LLM SDK imports), SaaS logs, and developer interviews.
- Deploy the detections above to your SIEM/EDR and validate them against known-good agent workloads before enabling high-severity alerting.
- Egress filtering: restrict agent hosts to an allowlist of required API endpoints (e.g., your LLM provider, internal services). Block paste/file-sharing domains and direct-to-IP HTTPS from server VLANs.
- Kill standing shell access: agents that do not strictly need OS command execution should have that tool removed. If shell tools are required, sandbox execution in containers with no network except an explicit proxy.
Short term (1–4 weeks):
5. Least privilege for agent identities: every agent service account gets scoped, short-lived credentials. No agent should hold domain-wide read access, wildcard database grants, or cloud * permissions. Rotate any keys found embedded in .env, mcp.json, or framework config files (the audit script above locates them).
6. Human-in-the-loop gates for destructive or high-impact tool calls: data export, mass reads, and external HTTP requests above threshold should require approval or step-up authentication.
7. Prompt and tool-call logging: capture full agent traces (inputs, tool invocations, outputs) to a tamper-evident store. During an investigation, this is the difference between reconstruction and guesswork.
8. Segmentation: place agent workloads in isolated subnets/VLANs with no direct path to production databases or file shares; broker all access through authenticated APIs with per-agent rate limits.
Strategic: 9. Adopt a governance framework: map controls to the OWASP Top 10 for LLM Applications and MITRE ATLAS, and fold agentic AI scenarios into your IR playbooks and tabletop exercises. 10. Regulatory readiness (GDPR/EU): AEPD's disclosure signals supervisory expectations. Document your AI-agent risk assessments under GDPR Art. 35 (DPIA), and ensure your 72-hour breach notification workflow accounts for agent-driven incidents where the "attacker" may be your own compromised automation.
Conclusion
The AEPD disclosure is a line in the sand: autonomous, multi-stage AI attacks are now part of the confirmed incident record, not the threat-model appendix. The defenders who fare best against agentic threats will be the ones who treat AI agents as what they are — privileged, tireless, credential-holding identities that must be inventoried, least-privileged, egress-constrained, and monitored with the same rigor as any human administrator. Build the detections, close the permission gaps, and rehearse the playbook before your organization becomes the next regulator's case study.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.