AI Autopsy: Two Zero Days and an Agent Is Enough to Breach Dutch Security Non-Profit

The Dutch Institute for Vulnerability Disclosure (DIVD) proudly states that its mission is to make the digital world a safer place. It scans the web for known CVEs, tells asset owners when they’re exposed, and responsibly discloses zero-day vulnerabilities to vendors. But even this vast accumulated wealth of industry expertise was not enough to repel a recent agentic AI-powered breach.

If a specialist cyber-focused organisation like DIVD can be cornered by malicious machines, how can CISOs elsewhere respond to similar threats? While some details remain unknown at the time of writing, the case provides an interesting snapshot into a future of agentic attacks. And how organisations might best prepare themselves for machine-speed threats.

Containing the crisis

The DIVD’s crisis management team has been laudably open in its post-incident reporting. A regularly updated, detailed case file explains exactly what happened following discovery of the breach on September 24. Initial access was achieved through exploitation of two chained zero-day vulnerabilities in the Zammad helpdesk software. First, remote code execution (RCE) bug CVE-2026-102489 enabled a session hijack that led to code execution as the Zammad service user. Then elevation of privilege (EoP) flaw CVE-2026-102490 was exploited to achieve root access.

“To properly contain the threat, you must understand your network topology” Shane Barney

It seems Zammad was chosen deliberately, since helpdesk platforms are a valuable store of enterprise credentials, tokens, and keys. This could potentially have given attackers access to every system the support team interacted with. DIVD said investigations are still ongoing, but attackers took its members’ DIVD email addresses and possibly contact details. This could theoretically enable adversaries to impersonate the organisation’s volunteers in future attacks.

Keeper Security CISO Shane Barney tells Assured Intelligence that in such circumstances organisations must focus first on containing the threat.

“Any organisation running Zammad needs to patch to version 7 immediately or take it offline. Assume your staff directory has been compromised and take steps to lock down email systems, strengthen authentication on external communications and notify stakeholders that attackers may attempt impersonation,” he says.

“To properly contain the threat, you must understand your network topology and what systems are connected to what. If you do not have your enterprise infrastructure mapped, gaps will surface during this incident.”

Abnormal AI field CISO, Patricia Titus, agrees that patching should take priority in these situations.

“Without knowing the full extent of the attacker’s access, or whether backdoors are installed, assume the network is compromised,” she tells Assured Intelligence. “Move incident communications ‘out-of-band’, completely off the organisation’s network. Otherwise, the threat actor can watch your response and pivot if they believe they are about to be evicted.”

When agents go bad

In DIVD’s case, it became pretty clear early on that it was dealing not with a hands-on-keyboard threat actor, but an AI agent.

“Every security professional has feared this kind of attack” Patricia Titus

“The [logs] show the attacker’s scripts contain notes where the agent justifies its own actions, explaining why what it’s doing is okay and really not phishing, something a human attacker wouldn’t bother with,” DIVD said. “The attack was loud and very messy, with the agent working [in an] automated [way] and deciding each next step itself at speed on sloppy logic. Its overexplaining comments have made our reverse engineering a lot easier.”

It remains to be seen whose orders the agent was carrying out. Even though the attack was “loud and messy” – which enabled quicker detection by the DIVD team – it still achieved its task of exfiltrating data due to the sheer speed with which it operated. The pathway from hijacked session to root access took just seconds, according to Sysdig.

Fortunately, DIVD had best-practice network segmentation set up, which limited the blast radius. “Thanks to proper network segmentation and the actions of our IT and incident response team after detection, we were able to stop the attackers from going deeper into our systems and network,” it explained. “Unfortunately, some of the damage was already done.”

Abnormal AI’s Titus claims “every security professional has feared this kind of attack.” She questions whether existing tools can keep pace with the machine speed of agents.

“I saw a version of this in the early 2000s with ILOVEYOU and Blaster. Those threats morphed faster than AV signatures could be updated, and both viruses caused significant damage,” Titus continues. “Then, as with DIVD, the only option is often to take systems offline and cut off the outside world. That carries serious consequences. Imagine a company processing millions of transactions an hour going dark. The financial implications could be catastrophic. Detection and response must run at the same speed as the attack.”

Keeper Security’s Barney argues that architectural defence, rather than faster incident response, is the key to dealing with agentic attacks. “It’s quite simply not possible for your team to respond faster than an agent operates. Organisations must prioritise implementing systems designed around the assumption that compromise will happen and restrict lateral movement as a default,” he says.

“Zero-standing privilege, just-in-time access, network segmentation with enforcement and continuous monitoring are essential. These concepts are not new, but agentic AI has made them essential rather than optional.”

Brace for quieter attacks

Sysdig senior cybersecurity strategist, Crystal Morin, agrees with Barney that the lessons for CISOs are not necessarily out of the ordinary. “Nothing on the remediation list would have surprised anyone in 2018 or 2015. Segmentation, default-deny egress, credential hygiene, and so on,” she tells Assured Intelligence.

“Agentic threats will get quieter over time” Crystal Morin

“The work in front of most CISOs and security teams isn’t exotic. It’s the unglamorous programs and practices they already know, but now with a far shorter grace period.”

However, the future will bring further challenges as threat actors improve their prompts, she warns.

“Agentic threats will get quieter over time, because they’ll learn from their mistakes and their operators will continue to tune them,” Morin claims. “In the case of DIVD, the agent’s password spraying disrupted its own man-in-the-middle attack. The agent also annotated its reasoning in script comments. We saw the same self-narration with JadePuffer. But the sheer volume of noise will likely fade as models improve and operators get better at running agentic threats.”

Agentic AI has fundamentally changed the economics of cyber-attacks, and all CISOs will need to adapt to this new normal, argues Keeper Security’s Barney. Abnormal AI’s Titus is in agreement, noting that, if they weren’t already, security operations must run 24x7x365 to counter the threat from machines that don’t eat or sleep.

“This is a heavy burden for most companies, but waiting is no longer an option. This is going to be hard to sell to leadership when it means more funding to enhance or fully replace an existing investment,” she concludes.

“Too many vendors try to lock companies into technology that isn’t keeping pace. Rethink the five or seven-year commitments. When attackers move at machine speed, we have to pivot faster and stay flexible.”