Reported by 3 outlets

Timeline

1. original reporting

   "The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as “loud and very

   www.bleepingcomputer.com · 14d ago · September 29th, 2026

   "The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as “loud and very

   via Mastodon https://www.bleepingcomputer.com/news/security/automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd/

2. update from divd.nl

   It was a matter of when, not if...

   divd.nl · 18d ago · September 26th, 2026

   DIVD's initial public disclosure of its own breach, published roughly three days before the story's first_seen. The organization confirms it was hacked after almost seven years, states the modus operandi indicates an agentic AI powered attack, and says it is handling the case as worst-case-scenario and assume breach until proven otherwise. It blocked access to its infrastructure, started forensics with a third-party incident response team, reported the incident to the Autoriteit Persoonsgegevens and the National Cyber Security Centre, and discussed options with the police. The page itself carries no timestamp; published_at is the earliest Wayback Machine capture (2026-09-26 00:07 UTC), and the text promises the next public update on Monday 28 September.

3. update from linkedin.com

   DIVD LinkedIn update: entry by technical vulnerability, not Citrix NetScaler

   linkedin.com · 15d ago · September 28th, 2026

   DIVD states it has a good idea of the entry path, exploitation of a technical vulnerability whose details are withheld to avoid interfering with the investigation or creating more victims, and confirms it was not Citrix NetScaler; it sees no link to known public threat actors and no involvement by a former volunteer. The update describes the agent deciding each next step itself, polluting its own MITM attack with password spraying, and over-explaining its comments, which eases reverse engineering, and thanks NCSC-NL, Merlon Security and NVISO Security for support. A next public update was promised for Thursday October 1. published_at is derived from the LinkedIn post ID, which encodes creation time in its high bits (2026-09-28 15:43 UTC, a Monday, matching the promised schedule).

4. update from bleepingcomputer.com

   Automated AI agent used to breach cybersecurity nonprofit DIVD

   bleepingcomputer.com · 14d ago · September 29th, 2026

   The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as “loud and very, very messy.” Evidence uncovered during the ongoing investigation indicates the attacker exploited a vulnerability, but the attack's purpose and impact remain unclear at this stage. DIVD is a nonprofit organization of volunteer security researchers that scans the internet for systems affected by known vulnerabilities, notifies their owners, and provides information on how to mitigate the risks. Late last week, the organization said it had been hacked after seven years of uneventful operations, with the intrusion carried out autonomously by an AI agent. The organization described the attack as “loud and very very messy,” leaving plenty of evidence to help them reconstruct what happened, but the incident was serious nonetheless. The organization launched an investigation and informed the police, the Autoriteit Persoonsgegevens (data protection), and the National Cyber Security Center (NCSC). In an update on Monday, DIVD provided additional information about the incident but withheld full details to avoid influencing the investigation or putting more victims at risk. We could see the agent working automated, because after

5. mentioned by www.bleepingcomputer.com

   Automated AI agent used to breach cybersecurity nonprofit DIVD https:// bleepingcomputer.com/news/security/ automated-ai-agent-used-to-breac

   www.bleepingcomputer.com · 14d ago · September 29th, 2026

6. mentioned by www.bleepingcomputer.com

   "Automated AI agent used to breach cybersecurity nonprofit DIVD" "The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-dri

   www.bleepingcomputer.com · 14d ago · September 29th, 2026

7. mentioned by www.bleepingcomputer.com

   🤖 Dutch nonprofit DIVD (vulnerability disclosure) was breached by an autonomous AI agent: after exploiting an undisclosed flaw, the agent pi

   www.bleepingcomputer.com · 14d ago · September 30th, 2026

8. update from bleepingcomputer.com

   DIVD says Zammad zero-days enabled AI-driven network breach

   bleepingcomputer.com · 13d ago · September 30th, 2026

   The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. DIVD retrieved extensive details about the attack because the AI agent left behind clear explanations of its decisions, allowing the organization to reconstruct the incident. According to the cybersecurity nonprofit, the two flaws, now identified as CVE-2026-102489 and CVE-2026-102490, enabled session hijacking, remote code execution, and escalation to root privileges. After exploiting the vulnerabilities, the attacker was able to access other services, read and exfiltrate data from DIVD's systems, all actions performed in a matter of seconds, thanks to AI automation. “Used together, they allowed the attackers to hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack,” DIVD says . Due to network segmentation and incident response actions, the threat actor did not move deeper into the network. However, the investigation is still underway. Zammad is an open-source AI-powered helpdesk and support ticketing platform used to manage customer inquiries, IT support re

9. mentioned by www.bleepingcomputer.com

   DIVD says Zammad zero-days enabled AI-driven network breach https:// bleepingcomputer.com/news/security/ divd-says-zammad-zero-days-enabled-

   www.bleepingcomputer.com · 13d ago · September 30th, 2026

10. mentioned by www.bleepingcomputer.com

    🤖 Two Zammad 0-days (CVE-2026-102489, CVE-2026-102490) chained to hijack sessions, run code and escalate to root on DIVD's network in second

    www.bleepingcomputer.com · 13d ago · September 30th, 2026

11. update from www.bleepingcomputer.com

    An AI agent broke into the network of DIVD, the Dutch vulnerability disclosure non-profit, and chose its own steps as it went. It chained tw

    www.bleepingcomputer.com · 12d ago · October 1st, 2026

    An AI agent broke into the network of DIVD, the Dutch vulnerability disclosure non-profit, and chose its own steps as it went.