Quickly Enough

On September 15, 2026, Spain's data protection authority, the AEPD, published the first breach notification it has received for an attack executed by an AI agent. A person chose the target and started the tool. The agent did the rest. It searched generic files for weaknesses and logged in. It explored the application until it found a flaw. It modified personal data and opened invoices.

The agency answered with a sentence about time. Human supervision remains essential, it said, but it has to be supported by detection, containment, and response mechanisms capable of operating quickly enough.

What the AEPD published.

The notification came from the affected organization, and the agency says the facts are still to be analyzed. It makes no finding about the model, the provider, or the tool, and it reads no trend into a single case. Its conclusion is narrower than that. AI-executed attacks have reached the processing of real personal data.

The recommendations are specific. Risk analyses of processing should name AI-assisted and AI-executed attacks expressly, because automation changes the probability, the speed, and the scope of a breach. Automated access should reach only the functions it needs. Activity logs should allow an anomaly to be caught in time. Incident response protocols should cover an attacker that chains the phases of an attack with no human between them.

That last phrase is the one the rest of the notice turns on.

Quickly enough, measured against what.

A human attacker leaves gaps. Between the scan and the login, and again between the login and the exploit, a person reads output, decides, and types. A monitoring team works inside those gaps. An agent that chains phases closes them, and the interval between one action and the next becomes whatever the agent's loop takes.

Detection is measured against a clock. An alert fires some time after the behavior. Someone reads it some time after that. Containment lands when both intervals have run, and against an agent it is racing a loop that never stops to read.

A control that stands in the path of the action is measured against a different reference. The agent's next call does not execute until the control has set what that call may do, so there is no interval for the control to lose. Quickly enough, for a control in the path, means before the next action, and the next action cannot start without it. The control's own latency still has a cost. The action pays it, and the data does not.

If the control fails to answer, the action carries the grant declared for that case before the run, and a sound declaration withholds. A slow governor leaves an agent waiting. A slow detector leaves a controller writing a notification.

The login succeeded.

The second step in the sequence deserves the longest look. The agent logged in successfully. Whatever credential it used, the system that checks credentials said yes, and every action after the login inherited that answer.

The AEPD names digital identities and credentials as a critical exposure point, because an agent holding an account with excessive permissions works at machine speed before anyone detects an anomaly. Limiting permissions narrows what a compromised session can touch. The permission set was drawn before the session began, and it holds the same value on the first action and the fortieth.

What changed across this sequence was the behavior. An account is provisioned to do something, and that something is a trajectory with a shape. A session that logs in and then walks the application probing for flaws has left that shape before it writes anything. A governor sets authority per action on the divergence of realized behavior from the assured trajectory, so the exploration step is already an input to the grant on the write that follows.

Valid credential, less authority.

Read by an identity check, this session is trusted. The credential is valid and the login was clean. Trust, measured that way, reads high.

A governor with a forward look reads where the sequence is heading. Scan, login, exploration. None of those steps touched personal data, and each may have sat inside the account's permissions. The trajectory was still pointed at the write. A governor can grant less authority to a session whose trust reads higher, because its forward look caught the divergence before the write landed. The modification arrives at the enforcement point carrying the authority the governor granted, and on that trajectory the grant can be zero.

A detector needs something to recognize. A signature of the exploit, or the write itself, has to exist before it has anything to report. A governor needs the departure from the assured trajectory, and in a sequence shaped like this one the departure comes before the damage.

Where the obligation sits today.

The duty that reaches this incident now is the GDPR's. Article 32 requires security appropriate to the risk, and the agency has just told controllers that the risk includes an actor that chains phases without pausing. Article 33 gives the controller 72 hours from awareness to notify the supervisory authority. That clock measures the time allowed to report. It says nothing about the time the incident took.

The EU AI Act's high-risk obligations, human oversight and cybersecurity among them, apply from December 2, 2027 for standalone systems and August 2, 2028 for AI embedded in regulated products under Regulation (EU) 2026/1744. Until then the security article carries the load.

The recommendation to limit automated access applies in both directions. The attacker ran an agent against someone else's system. Organizations are putting agents of their own into their processing, and each of those agents holds credentials and permissions too.

What we are building.

Wayfinder Systems Group builds a runtime governor. It observes the governed system and assesses how far realized behavior has diverged from the assured trajectory. It sets how much authority the next action carries, and it enforces that grant at a point the system cannot step around. In a chained sequence the grant is set between every step, so the pace of the loop decides how often the governor answers and never how late. Each grant is sealed into the record as it is set. We call her Velma.