西班牙資料監管機關公布首起與 AI 代理程式相關的資料外洩通報

馬德里9月15日（路透社）——西班牙資料保護監管機關表示，已收到首件據通報、涉嫌由人工智慧（AI）代理程式造成的個人資料外洩通知。這起案例顯示，自主系統正開始在網路攻擊中扮演直接角色。MADRID, Sept 15 (Reuters) - Spain's data protection watchdog said it has received the first reported notification of a personal data breach allegedly carried out by an artificial intelligence agent, a case that suggests autonomous systems are beginning to play a direct role in cyberattacks.

西班牙資料保護局（AEPD）週一在其網站部落格表示，這起事件涉及一個 AI 代理程式使用一款廣為人知的大型語言模型來識別漏洞、取得系統存取權，隨後修改個人資料並存取發票。The Spanish Data Protection Agency (AEPD) said on Monday in a blog on its website that the incident involved an AI agent using a widely known large language model to identify vulnerabilities, gain access to a system and subsequently modify personal data and access invoices.

該機關表示，這起涉嫌外洩事件是由受影響組織向其通報，相關資訊仍在審查中。該機關並補充，使用特定 AI 模型並不代表該模型本身或其供應商基礎設施遭到入侵，也不代表該技術是為惡意目的而開發。The agency said that the alleged breach was reported to it by the affected organization and the information remains under review, adding the use of a particular AI model did not mean either the model itself or its provider's infrastructure was compromised, nor that the technology was developed for malicious purposes.

AEPD未立即回應路透社的採訪請求，也未透露該大型語言模型或遭外洩事件鎖定的組織名稱。AEPD did not immediately respond to a Reuters request for comment, nor identify the large language model or the organization targeted by the breach.

該機關表示，這起案例之所以重要，是因為據稱有第三方在有限人為介入下，使用 AI 代理程式執行攻擊的多個階段，凸顯自主系統在資安事件中日益重要的角色。The agency said the case was relevant because a third party allegedly used an AI agent to carry out multiple stages of an attack with limited human intervention, highlighting the growing role of autonomous systems in cybersecurity incidents.

在企業快速採用 AI 技術之際，美國與歐洲的監管機關和資安主管機關也正加強審視能力日益強大的 AI 系統所帶來的風險。The incident comes as regulators and cybersecurity authorities across the United States and Europe increase scrutiny of the risks posed by increasingly capable AI systems, even as businesses adopt the technology at a rapid pace.

優先考量公共安全PRIORITISING PUBLIC SAFETY

西班牙已將自身定位為歐洲最積極倡議「可信賴 AI」模式的國家之一；此一模式保護隱私、民主、未成年人與公共安全，而非優先考量科技業的速度或獲利。Spain has positioned itself as one of Europe's most vocal advocates of a "trustworthy AI" model that protects privacy, democracy, minors and public safety rather than prioritising speed or profit for the tech industry.

AEPD補充，單一案例不足以確立更廣泛趨勢，但這項通報顯示，AI輔助攻擊正超越理論階段，開始影響現實世界中的個人資料處理。While a single case is insufficient to establish a broader trend, the notification suggests that AI-assisted attacks are moving beyond the theoretical stage and are beginning to affect real-world processing of personal data, AEPD added.

根據受影響組織提交的通報，該代理程式先成功登入系統，之後自主搜尋應用程式弱點。辨識出一項漏洞後，它便能變更個人資訊並查看帳務紀錄。According to the notification submitted by the affected organisation, the agent successfully logged into the system before autonomously searching for application weaknesses. After identifying a vulnerability, it was able to alter personal information and view billing records.

西班牙監管機關未說明何時會完成對這起通報外洩事件的審查。The Spanish watchdog did not say when it would finish reviewing the reported breach.

該機關表示，AI不會創造新的威脅。不過，它會提升既有惡意手法的速度、規模與適應能力，縮短偵測與遏止這些手法的可用時間。The agency said AI does not create new threats. However, it increases the speed, scale and adaptability of existing malicious techniques, reducing the time available to detect and contain them.

該機關補充，個資控管者、受託處理者與資料保護長必須為攻擊速度將持續加快的情境做好準備。Controllers, processors and data protection officers must prepare for a scenario in which the speed of attacks will continue to increase, the agency added.

（Corina Pons報導；Aurora Ellis編輯）(Reporting by Corina Pons; Editing by Aurora Ellis)