AI Agent Hacks DIVD Security Researchers Using Chained Zammad Zero-Days

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a security breach after malicious actors deployed an AI agent to exploit two zero-day vulnerabilities in the Zammad support platform. The chained exploit allowed the automated attacker to hijack sessions, run code remotely, and escalate privileges to root in a matter of seconds. The software vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490, received 9.4 CVSS scores under the chained attack scenario. Incident responders analyzing the attack logs found embedded notes within the scripts, indicating the AI was independently generating text to justify its own actions as it navigated the network. DIVD confirmed that the attackers stole data belonging to its volunteer security researchers, including email addresses. "We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern." — DIVD