AI-Agent Attack, EU Cyber Risks and Federal Cloud Gaps Lead September Security Roundup
Summary
A September roundup covers EU cyber risks, an AI-agent-assisted breach, new AI and privacy guidance, NIST’s OT security draft, and widespread federal agency delays in implementing cloud security controls.
Key points
- ENISA recorded 8,257 incidents affecting EU organizations in 2025; DDoS and unauthorized access led the data, while vulnerability exploitation featured in 60.4% of unauthorized-access cases with an identified intrusion vector.
- Spain’s AEPD reported a personal data breach in which an attacker used an AI agent to find application vulnerabilities, modify personal data and access invoices; the incident remains under regulatory analysis.
- The UK NCSC proposed a five-dimension framework for assessing agentic cyber-defense risks, emphasizing restricted scope, human oversight and the ability to recover from mistaken actions.
- A DHS OIG audit found that 78 of 102 reviewed federal agencies had not implemented all mandatory SCuBA cloud security policies by February 2026, including controls for outdated authentication and MFA.
- NIST’s draft OT security guidance integrates CSF 2.0 and emphasizes enterprise risk governance, safety-conscious controls, monitoring and management of cloud and third-party dependencies.
- The EDPB proposed a five-step approach to deciding when GDPR fines should be imposed; an Advocate General separately said consent to marketing by unidentified “partners” may not support later marketing without fresh consent.
- Spain’s AEPD warned an employer about a planned AI recruitment tool, stressing privacy by design, risk assessment and meaningful human review where automated decision-making rules apply.
Article Details
- Event Type
- Cybersecurity and data-protection news roundup covering regulatory guidance, threat reporting, an AI-agent-related data breach, and a federal cloud-security audit.
- Impact
- ENISA reported that DDoS accounted for 51.3% of recorded 2025 incidents and unauthorized access for 39.5%, while warning its open-source and voluntary dataset is not a complete measure. In a breach notification to Spain’s AEPD, an attacker reportedly used an AI agent to find vulnerabilities, modify personal data, and access invoices; the facts remain subject to regulatory analysis. A DHS OIG audit found that 88 of 102 reviewed federal agencies had not implemented all mandatory SCuBA policies by the June 2025 deadline, leaving cloud environments exposed to preventable cyberattacks and data loss.
People
Letitia JamesNew York Attorney General who led the coalition of state and territorial attorneys general calling for a federal frontier-AI safety framework.SpielmannAdvocate General who delivered the Opinion in Groupe Canal + SAS v CNIL.Wes MooreMaryland Governor who announced the state’s artificial intelligence framework.
Threat Actors
Vendors
AnthropicAI agents. It cites a series of reported 2026 security incidents involving systems developed by OpenAI, Anthropic, Meta and other laboratories. Among them, the attorneys general point to the July incident in whichMetaIt cites a series of reported 2026 security incidents involving systems developed by OpenAI, Anthropic, Meta and other laboratories. Among them, the attorneys general point to the July incident in which OpenAIOpenAIAI agents. It cites a series of reported 2026 security incidents involving systems developed by OpenAI, Anthropic, Meta and other laboratories. Among them, the attorneys general point to the July incident in
Countries
Industries
business servicestechniques remained important components of the criminal ecosystem. Manufacturing, business services and public administration were among the sectors particularly affected by cybercrime.Finance/bankingrecorded incidents, followed by business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%). ENISA links differences in sector exposure to factors including digital dependencies,Manufacturingand other social-engineering techniques remained important components of the criminal ecosystem. Manufacturing, business services and public administration were among the sectors particularly affected byPublic administrationremained important components of the criminal ecosystem. Manufacturing, business services and public administration were among the sectors particularly affected by cybercrime.Transportationmost affected sector, accounting for 31.8% of recorded incidents, followed by business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%). ENISA links differences in sector exposure to