The chain with no human
The Spanish Data Protection Agency has reported the first data breach in Spain executed end-to-end by an AI agent (Source: securityweek.com).
The agent did reconnaissance, logged in, probed the application and modified data with no human operator at any step.
That is what is new. Until now, the cases that got published always had a person deciding the next move, even remotely and with a model's help.
Not here. The agent closed the entire chain.
The main case
The same week, researchers at Hacktron documented another chain worth reading slowly (Source: securityweek.com).
It started in libheif, the library that decodes HEIF images, and in ImageMagick, the classic conversion tool. A flaw in that image processing opened the first door.
The second door was not a flaw, it was a configuration. OpenAI's SSO was misconfigured, and that misconfiguration let the chain keep moving into internal repositories.
They used Claude Opus 5 to build the exploit.
Look at the sequence. A flaw in a decoding dependency, a service that shares identity with another, and an AI tool that speeds up the hard part. None of the three steps is exotic on its own. Together they form a chain that enters where nobody looks.
What stands out is not the sophistication. It is that the chain holds on pieces that have been in any company's inventory for years.
The pattern
Both stories share a shape. An agent or an automated chain walks through steps that used to require human hands, and it does so at a speed classic controls were not designed to see.
In the AEPD case, the agent needed nothing strange. It did what a patient attacker would do, but without pauses and without getting tired.
In the Hacktron case, the AI did not replace the attacker. It took away the heavy work of building the exploit, which is exactly the part that used to filter out amateurs.
I have checked it myself, without being an expert in anything: the entry barrier is now very low and the volume of attempts rises.
The other side
AI agents as attackers? The agent is also the attacker's tool, and this week there are two clear examples.
The first is Hacktron, with Claude Opus 5 building the exploit.
The second is LeakySensey, an attacker who compromised more than 87,000 IP addresses through brute force against devices with PPTP and L2TP and credentials like admin123 (Sources: escudodigital.com, cybernews).
He rented them as proxies and made 202,000 dollars since 2024. He automated the operation with a modified version of Claude Code, presumably local.
There is the direction that matters. It is not that AI attacks on its own, it is that a single operator scales what used to require a team.
My own reading
My reading is that the problem is not the agent's autonomy, it is the surface we leave for it. And skipping the catastrophic tone.
A misconfigured SSO is a door you share between services. If the agent enters through it, it enters all of them at once.
An unpatched decoding dependency is a door almost nobody looks at. libheif does not come up in risk meetings.
And a VPN with PPTP or L2TP and default credentials is a door that has been open for years and nobody has closed because nobody uses it.
The three controls that would have stopped these attacks are concrete. Phishing-resistant MFA, isolation of services that share SSO, and patching of image decoding dependencies.
None is expensive. None is new. The problem is that none is on this week's priority list.
What to check
- Check your SSO. See which services share the same identity provider and whether a failure in one gives access to the rest. If the answer is yes, split them by criticality.
- Audit stale VPNs. Look for PPTP and L2TP in your inventory, check whether they are still exposed and change any default credential you find. admin123 is not a password, it is an invitation.
- Look at image dependencies. libheif and ImageMagick process files anyone can upload. Check that they are patched and that the service using them does not have excess permissions.
How I would test it in my lab
I would set up a container with an old version of ImageMagick and libheif, feed it malformed HEIF images and see what happens.
I would do it on an isolated network, with no internet egress, because the goal is to see the behavior, not to reproduce the exploit.
I would watch whether the process crashes, whether it writes anything outside its directory or whether it opens a connection it should not.
With that I would have a cheap conclusion. If the service that decodes images has write permissions where it should not, the library flaw stops being a flaw and becomes a breach.
Closing
The lesson of the week is not that AI attacks on its own. It is that the doors we have left open for years are now walked through at a speed we had not seen.
Closing three of them costs less than explaining why we did not.
Originally published at https://sammideblas.com/notas/ai-agent-runs-first-end-to-end-breach-in-spain
