Category: AI Agent Security | Reading time: 6 min
The Breach
On 30 September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) published case DIVD-2026-00014: it was breached through AI agents. First access landed on 21 September 2026. By 22 September, DIVD had blocked datacenter access, stood up incident response with Merlon Security, and notified Dutch authorities.
DIVD’s own framing is direct: “DIVD got hacked through AI agents.” In a 24 September LinkedIn update quoted by SecurityWeek, the institute called the modus operandi an agentic attack it had not seen before—not because it was the first intrusion, but because of how the attacker moved.
The Zero-Day Chain
Investigation of the breach produced case DIVD-2026-00015 and two CVEs assigned by DIVD:
- CVE-2026-102489 (CVSS 9.4): session hijack leading to remote code execution as the Zammad user. DIVD says versions 6.3.0–6.5.4 are exploitable; 7.0.0–7.1.3 carry the defect but are not exploitable under current environment conditions. - CVE-2026-102490 (CVSS 9.4): local privilege escalation from the Zammad user to root, present across versions including the latest alpha through at least v7.1.0-alpha.
DIVD’s public line, reported by BleepingComputer and SecurityWeek: used together, the flaws “allowed the attackers to hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack.”
From there the actor accessed other services and exfiltrated data. Network segmentation and response actions stopped deeper movement. DIVD still assumes breach until it can prove otherwise. On 1 October 2026 it published an overview of which data was compromised and which was not.
Why the Timing Matters
DIVD reported the vulnerabilities to Zammad on 24 September 2026. By 26 September it was scanning publicly reachable instances and notifying owners. Its advisory to Zammad operators is blunt: upgrade to version 7 or take the instance offline. A log-check script is available for hunting indicators of compromise.
Zammad is a widely deployed open-source helpdesk. Self-hosted ticket systems sit next to identity, mail, and internal tooling. An agent that can chain unauthenticated RCE into root on that surface is not a lab curiosity—it is a production authorization failure measured in seconds.
What Deployers Should Take From It
BleepingComputer reported that DIVD could reconstruct the incident in part because the AI agent left clear explanations of its decisions. That is useful for forensics and insufficient as a control. Self-narration is not an authorization log.
For any team running agents that can reach production systems—or for any team whose ticket stack can become the foothold—the questions are ordinary and non-negotiable:
Who authorized the agent. What scope it was given. Which systems it reached. Whether a blocked step stayed blocked. Whether that record can be verified after the fact without trusting the model’s self-report.
DIVD’s case files turn those questions into an incident timeline with CVEs, a root shell measured in seconds, and confirmed exfiltration. Segmentation bought time. Write-time evidence of identity and enforcement is what turns “assume breach” into something an examiner or insurer can actually read.
Source: DIVD-2026-00014 · DIVD-2026-00015 · BleepingComputer · SecurityWeek