The First Agentic Breach Is On the Record. Your Response Time Just Became the Control.

The First Agentic Breach Is On the Record. Your Response Time Just Became the Control.

Week of 21 September 2026 | Compiled by Team Paringa

This week the theoretical became regulatory fact: an AI agent ran an intrusion end to end and a European supervisory authority wrote it up. Alongside it, a UK fintech spent five months answering an attacker's data requests, and an identity appliance many enterprises rely on shipped with a perfect-score authentication bypass.

What Happened This Week

🔴 Spanish regulator records the first breach executed by an AI agent, as Mandiant confirms agents now run full intrusions

The Spanish Data Protection Agency (AEPD) published details on 16 September of what it describes as the first personal data breach notification in which a third party used an AI agent as the instrument to chain together the phases of an attack. The agent achieved a successful login, searched for vulnerabilities, then gained the ability to modify personal data and access invoices. The AEPD is careful with its language and the investigation is continuing, but the agency's assessment is that this represents a qualitative change: an agent can receive a goal, plan intermediate tasks, use tools, execute code, interpret results and adjust its actions autonomously, all at machine speed.

The AEPD draws four conclusions for risk owners. AI-assisted and adversarial agents must be part of every risk analysis. Incident response times must improve. Digital identities and credentials need better protection because they are the agent's first foothold. And none of this can be achieved through manual intervention alone. In the regulator's words, human supervision remains essential but must be backed by detection, containment and response mechanisms that operate fast enough to matter.

The same week, Mandiant's 2026 AI Risk and Resilience report reached the same conclusion from the attacker's side. It finds adversaries have moved from prompting chatbots for research to letting autonomous agents execute entire intrusions, and cites a hijacked coding assistant that spread a self-propagating worm across roughly 100 repositories and a compromised CI/CD credential that let an attacker co-debug exfiltration tooling with an LLM in real time. Mandiant also flags a new financial risk class: a corrupted input sent an accounting agent into a runaway loop that racked up more than 15,000 API calls and roughly $50,000 of cloud cost in under an hour.

Separately, researchers at Air disclosed Plugin4Shell, a zero-click flaw in the plugin update path of Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI that lets an attacker who controls a plugin repository push malicious code to already-installed agents without user action. Anthropic and OpenAI have shipped fixes; Microsoft had not patched Copilot at time of writing and Google says the deprecated Gemini CLI will not be fixed.

Sources: SecurityWeek, SecurityWeek (Mandiant report, Plugin4Shell)

The AEPD's four points read like a managed detection and response scope document, and that is not a coincidence. An agent that logs in, enumerates, and pivots in minutes does not wait for a Monday-morning ticket queue, so the question for a UK or European CISO is no longer "do we have MFA and EDR" but "what is our mean time to contain when the attacker never sleeps". If your SOC is an 8x5 team plus an on-call phone, the honest answer is measured in days. Board-level ask this quarter: get a measured containment time for a credential-led intrusion, in hours, and decide whether you are prepared to live with it. If you cannot produce the number, that is the finding.

🟡 Revolut fed customer data to a fake government agency for five months; 680 high-value accounts exposed, $3m ransom demanded

Revolut confirmed that its Lithuania-based subsidiary, Revolut Bank UAB, responded for roughly five months to fraudulent legal-disclosure requests sent from a genuine Italian Ministry of the Interior email account (a pec.interno.it address). The attacker did not breach Revolut's systems. They bought or reused infostealer logs containing a government employee's credentials, then simply asked for the data, and because the bank is obliged to respond to lawful requests, it complied. Hudson Rock says it is aware of more than 300 compromised credentials associated with that government domain.

The haul covers approximately 680 customers, reportedly selected by blockchain analysis of wallet activity, and includes identity and contact details, dates of birth, postal and email addresses, phone numbers and copies of passports and driving licences. A threat actor using the handle "IAmNotAVillain" publicly demanded $3 million on 16 September and claims a related theft of over 147GB of data from an Italian law enforcement agency; Italian police have opened an investigation. Revolut says customer funds are unaffected and that it has received no direct demand.

Sources: SecurityWeek, BleepingComputer

Five months of disclosures through a legitimate channel is not a detection failure of the SIEM kind; it is a process with no anomaly baseline. Every regulated firm in the UK and EU runs a law-enforcement and regulator request desk, and almost none of them treat it as an attack surface with volume, sender and pattern monitoring. Under DORA and the incoming UK Cyber Security and Resilience Bill this is exactly the kind of third-party and process risk supervisors will ask about. Practical action this week: pull 12 months of legal-request logs, look for sender concentration and off-hours submissions, and put a second-channel verification step on any request for identity documents. Cheap to do, and it would have stopped this in month one.

🟡 Cisco ISE zero-day (CVSS 10.0) exploited in the wild; 77 new Cisco CVEs in one week, 41 of them in ISE

Cisco warned on 17 September that CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine and ISE Passive Identity Connector, is under active exploitation. An unauthenticated remote attacker can send a crafted request to an API endpoint and gain access to the management interface; Cisco says successful exploitation may yield root command execution, which means attackers can also erase the evidence. There is no workaround. Fixes are available for ISE 3.1 through 3.5, and CISA added the CVE to its Known Exploited Vulnerabilities catalogue on 16 September with a three-day patch deadline for US federal agencies.

The advisory landed days after a separate CVSS 9.8 flaw in Cisco Secure Email Gateway (CVE-2026-76461) was confirmed exploited, and alongside 77 new Cisco CVEs, 41 affecting ISE and 28 affecting the Secure Firewall portfolio, several of them also rated 10.0. Cisco's detection guidance is to grep the ISE access log for unexpected usernames on every node in a distributed deployment, and to re-image any node showing signs of compromise.

Sources: The Hacker News

ISE is the policy brain for network access in a large share of UK enterprise and public-sector estates, so a root-level bypass here is an identity and network compromise in one move. Two things matter more than the patch itself. First, the hunt: Cisco's own guidance is log review across every node, and if you have no central log retention for ISE you cannot answer the "were we already hit" question. Second, exposure: management interfaces on identity infrastructure should never be reachable from anywhere but a hardened jump path, and this is the week to prove that with a scan rather than a diagram.

What CISOs and IT Leaders Are Dealing With

The common thread this week is that the attacker's clock has sped up while the defender's has not. An AI agent chains login-to-data in minutes; a social engineer with a stolen government mailbox runs a five-month collection programme through the front door; an appliance zero-day gives root and a way to delete the traces. None of these were stopped by preventive controls, and all three were bounded only by how quickly someone noticed anomalous behaviour, or in Revolut's case, did not.

For UK and European mid-market and enterprise firms this is landing at the same time as the regulatory clock. DORA is in force, NIS2 transposition is complete across most member states, and the UK Cyber Security and Resilience Bill has finished four sittings of Lords committee scrutiny with 65 amendments tabled, bringing managed service providers and data centres into scope with 24-hour incident notification. Supervisors will not be asking whether you had MFA. They will be asking how long the attacker was inside, and what you did in the first 24 hours.

Three Things Worth Watching Next Week

1. AEPD follow-up on the agentic breach - The agency has said its investigation is ongoing. Any detail on how the agent gained its initial login (jailbroken commercial model, escaped test harness, or custom tooling) will set the template for how EU regulators treat AI-instrumented attacks under GDPR Article 33.

2. Cisco ISE exploitation reporting - With CISA's federal deadline passed on 19 September, expect the first incident-response write-ups naming the actor and the post-exploitation tooling. Confirm your ISE patch level and log review are complete before those arrive.

3. Lords report stage on the Cyber Security and Resilience Bill - Watch which of the 65 amendments survive, especially director personal liability and the MSP scope definitions. If you run or buy managed services, the reporting obligations will land on both sides of the contract.

Questions? hello@paringa.ai

Paringa delivers managed detection and response, threat intelligence and advisory through the vCyberiz Cyber Fusion Centre and vRespond+ MDR, mapped to the DIRECT framework (Data, Identity, Risk, Endpoint, Cloud, Threat). When the attacker is an agent, the only control that scales is a response that runs at the same speed. | 21 September 2026 | © Paringa Ltd