The DIVD AI agent breach that rattled the Dutch volunteer security research community has sharpened into focus: the attack exploited two critical zero-day vulnerabilities in The Register-confirmed open-source helpdesk and customer support ticketing system Zammad, and by 1 October the organisation had confirmed that data had been exfiltrated. An automated AI agent, described by the Dutch Institute for Vulnerability Disclosure (DIVD) as operating at ‘the speed of light and sloppy logic,’ carried out the post-exploitation work autonomously after seven years of uneventful operations for the nonprofit.
DIVD is a nonprofit organisation of volunteer security researchers that scans the internet for systems affected by known vulnerabilities, notifies their owners, and advises on mitigation. Being on the receiving end of a breach, rather than responding to one, is awkward enough. Being breached by an AI agent is the kind of irony that tends to stick.
The Zammad vulnerabilities behind the DIVD AI agent breach
The two flaws at the heart of the incident are CVE-2026-102489, a remote code execution bug, and CVE-2026-102490, an elevation of privileges flaw. According to Infosecurity Magazine, when chained together the two carry a CVSS score of 9.4, placing them firmly in the critical bracket. The vulnerable system, Zammad, is open-source software used for helpdesk and customer support ticketing, not exactly the kind of target you would write a threat-intelligence report about, which may be precisely why it was attractive.
DIVD had specifically noted in its initial disclosure that the exploited system was not Citrix NetScaler, a detail it volunteered presumably to head off assumption. The confirmation that Zammad was the actual target arrived with DIVD’s fuller update, published on 1 October.
An agent that over-explained itself
What makes the incident unusual is not the vulnerability class but the method of exploitation that followed it. Once the threat actor had a foothold via the remote code execution flaw, an AI agent took over post-exploitation activities autonomously. DIVD’s own account of watching it work is worth quoting directly: ‘The attack itself was loud and very very messy. We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern.’
The agent, the organisation said, did ‘some pretty dumb things,’ including interfering with its own adversary-in-the-middle attack through password spraying. It also had a habit of over-explaining its decisions in comments, behaviour DIVD attributes to poor training and configuration for this kind of operation. That sloppiness, frustrating as it doubtless was in real time, left a trail of evidence that researchers have been able to use to reverse-engineer what happened step by step.
‘This is an attack we have not seen before. Not because it’s our first, but because the modus operandi indicates that this is an agentic AI-powered attack,’ DIVD explained in its initial disclosure.
Data confirmed exfiltrated, investigation ongoing
The 1 October update brought a harder finding. Sysdig confirmed that DIVD has acknowledged data exfiltration as a result of the breach. The full scope of what was taken has not been disclosed, with DIVD deliberately withholding details to avoid influencing the ongoing investigation or alerting the threat actor to what is and is not known.
DIVD informed the Dutch police, the Autoriteit Persoonsgegevens (the national data protection authority), and the National Cyber Security Center (NCSC) following discovery of the intrusion. The organisation has also committed to notifying other potential victims of the same Zammad vulnerabilities as soon as it is able to do so without compromising the investigation, which is a recognisable posture for a body whose entire mission is responsible disclosure.
BleepingComputer reported that it contacted DIVD for further detail on the patch state of the flaw before publication but had not received a response. The patch state of the Zammad vulnerabilities, and how widely the same flaws may have been exploited elsewhere, remain open questions ahead of any broader disclosure DIVD makes once the investigation allows it.
DIVD’s promised full update, tied to the 1 October date it set itself, is now due, and with data exfiltration confirmed and two critical CVEs named, the next disclosure will be one the broader security community is watching closely.
