DIVD Breach Points to Sloppy Autonomous AI Agent After Unnamed Vulnerability Exploit

That second part matters. The popular fear is a flawless machine that moves faster than any defender can react. What DIVD describes is a fast but careless agent that got in the way of its own techniques and wrote notes explaining its decisions as it went.

What DIVD has confirmed so far​

DIVD disclosed the breach on September 24, 2026, and was blunt about it. The nonprofit wrote that it took "(almost) seven years" before it could say "we're the hackers that got hacked." It said it blocked access to its infrastructure and started a forensics investigation with the assistance of a third-party incident response team.

DIVD's first post also explained why this case stands out: "This is an attack we have not seen before. Not because it's our first, but because the modus operandi indicates that this is an agentic AI powered attack."

The organization took a cautious line. It said it can't rule anything out yet, so it is treating the situation as a worst-case scenario and assuming breach until proven otherwise. The same day, it informed the directly involved parties, reported the incident to the Autoriteit Persoonsgegevens (the Dutch data protection authority) and the National Cyber Security Centre, and discussed its options with the police.

DIVD first announced the attack on LinkedIn, as DataBreaches.net noted. The organization had promised another update on Monday, September 28.

Summary: Breach confirmed, infrastructure isolated, outside forensic team brought in, Dutch authorities notified. The AI attribution is DIVD's own working assessment. It is not yet a published forensic finding.

The Monday update: a vulnerability, then a messy agent​

BleepingComputer reported on DIVD's September 28 update. DIVD added detail but held back specifics so it would not affect the investigation or put other victims at risk.

The key points from that update:

• Initial access came through a "technical vulnerability" in a system DIVD has not named. DIVD specifically said the flaw was not in Citrix NetScaler. That rules out one popular guess but still leaves defenders without a product to patch.
• An AI agent handled post-exploitation. DIVD said it could see the agent working on its own. After each action it chose its next step, very quickly and with what DIVD called sloppy logic.
• The agent tripped over itself. DIVD says the agent did "some pretty dumb things." For example, its password spraying interfered with its own adversary-in-the-middle (AiTM) attack.
• It over-explained its work. DIVD says the agent justified its decisions in comments, which gave investigators a trail to follow.

DIVD summed up the whole thing as "loud and very very messy." According to BleepingComputer, DIVD believes that the agent was poorly trained and configured for such operations, leaving behind sufficient information to help researchers with reverse-engineering the incident.

Put simply, this intruder made a lot of noise and kept a detailed diary. Human attackers try hard to avoid both.

Summary: The claimed chain is exploit first, then an autonomous agent moving around inside. The agent's poor tradecraft is what gave it away.

What we still don't know​

This is where hype tends to overtake the evidence, so here is the list of open questions:

The organization promised to provide a more detailed update on October 1, and to notify other possible victims of the same vulnerability as soon as they can. Until then, any claim about the vendor, the data taken or the attacker is guesswork.

One more caveat: the evidence so far only supports an agent making decisions after the initial exploit. It does not show that an AI picked DIVD as a target or found the vulnerability.

How this fits the wider trend​

DIVD's case is not the only one. Earlier in September, BleepingComputer covered a Google Threat Intelligence Group (GTIG) report describing attackers who are moving from AI coding assistants to multi-agent frameworks. In one case, a financially motivated attacker broke into an organization's cloud infrastructure and used autonomous agents to run a mass credential-harvesting campaign.

Google's report also added a caveat worth keeping in mind here. According to BleepingComputer, GTIG said fully autonomous hacking has not become widespread. It also said it had not seen attackers deploy fully autonomous pipelines to find zero-days and break into real-world networks.

DIVD's account fits that picture. The attacker's way in was an existing vulnerability, and the agent did the follow-up work quickly and clumsily. Nothing connects the DIVD attacker to the actors in Google's report. The comparison is about the pattern, not about who did it.

Why defenders should care, even with a clumsy agent​

Is a bumbling AI intruder actually reassuring? Only partly. The following analysis draws on general industry practice, not on anything DIVD has published:

• Cheap attacks get repeated. An agent that costs little to run doesn't need to be clever. It can try the same steps against many organizations until one attempt works.
• Patching speed matters more than ever. Once attackers are in, agents cut the time between steps. Closing the initial vulnerability quickly is still the most effective control. That is also why DIVD's future victim notifications matter.
• The techniques are familiar. Password spraying and AiTM credential theft are well-known methods, and so are the defenses:
• Enforce phishing-resistant MFA (such as FIDO2 security keys or passkeys) for high-value accounts. It holds up much better against AiTM token theft than one-time codes do.
• Alert on many failed sign-ins spread across many accounts from a single source. That pattern is the usual sign of password spraying.
• Watch for sudden bursts of activity from one account. A fast, noisy agent should stand out against normal behavior.
• Noise works in your favor if someone is watching. DIVD caught the activity partly because it was so loud. Organizations without monitoring or log retention would have nothing to reconstruct afterwards.

Windows and Microsoft 365 admins should note that DIVD has named no Microsoft product and no Microsoft link. The lessons here are general and apply to any environment.

The bottom line​

DIVD has handled this openly. In its own words, the aim was to be open, transparent and honest, even if it sucks. For now, what's public is a confirmed breach, an unnamed initial-access flaw, and an agent that DIVD describes as fast, autonomous and sloppy.

The October 1 update should be the next real source of detail. Admins should watch for three things: which product was exploited, whether a patch exists, and whether DIVD releases indicators or scripts others can hunt for. Once those details are public, other organizations can check whether the same flaw is present on their own networks.

Update: DIVD identifies Zammad zero-day chain as entry point (September 30, 2026)​

BleepingComputer reports that DIVD has now identified the unnamed initial-access issue as two zero-day vulnerabilities in the Zammad ticketing platform: CVE-2026-102489 and CVE-2026-102490. DIVD says the chained flaws allowed session hijacking, remote code execution and privilege escalation from the Zammad user to root.

Contrary to the earlier uncertainty about whether data was accessed, DIVD says the attacker read and exfiltrated data after gaining access. Network segmentation and DIVD’s response prevented deeper movement, though its investigation remains ongoing.

DIVD says it disclosed the flaws with Merlon Security and is warning other potentially exposed Zammad users. Its immediate advice is to upgrade to Zammad version 7, which it considers safe, or take affected instances offline as soon as possible.