AI agent breached Dutch cybersecurity nonprofit via Zammad zero-days
An autonomous AI agent breached the Dutch Institute for Vulnerability Disclosure (DIVD) through a chain of zero-day vulnerabilities in the open-source Zammad support platform, marking one of the first documented cases of an agent-orchestrated network compromise targeting a security research organization.
DIVD disclosed the September 21, 2026 intrusion on September 30, saying the attacker exploited two previously unknown flaws—CVE-2026-102489 and CVE-2026-102490—in Zammad to gain initial access and escalate privileges to root across its network. The vulnerabilities, used in combination, enabled session hijacking, remote code execution, and privilege escalation "in seconds, due to the agentic part of this hack," according to DIVD.
Attack chain and scope
The first vulnerability (CVE-2026-102489) permitted unauthenticated remote code execution and session disclosure; the second (CVE-2026-102490) allowed local privilege escalation to root. Security researchers at Merlon Security worked with DIVD to identify the flaws, which had not been previously disclosed.
Once inside, the attacker accessed other services running on DIVD's network and read and exfiltrated data, though the full scope of the breach remained under investigation. DIVD characterized the attack as "loud and very, very messy," suggesting the agent's actions were not stealthy but rather forceful and rapid in execution.
Significance for agent security
This incident represents a concrete case of autonomous agent capabilities—chaining exploits, escalating privileges, and orchestrating data theft—applied to compromise a real organization. Unlike theoretical or laboratory demonstrations, the DIVD breach shows agents executing a multi-stage attack against live infrastructure in the wild.
Zammad, widely deployed in support ticket systems across enterprises, became the attack vector. Organizations running unpatched instances face the same exposure DIVD experienced. The speed and coordination of the compromise—completing privilege escalation and data exfiltration in seconds—underscores how agent-driven attacks can collapse the typical time window available for human detection and response.
The Register reported that attackers stole email addresses from DIVD's systems, expanding the potential harm beyond the organization itself.
Next steps
No criminal charges, regulatory action, or civil lawsuits related to the breach have been publicly announced. The attacker's identity and the AI system operator remain unknown. DIVD and Zammad have not disclosed a timeline for patches or mitigation guidance.