Published 2 October 2026 · Updated 19 October 2026
Let me tell you a story about the irony of the year.
The Dutch Institute for Vulnerability Disclosure, or DIVD, is a nonprofit staffed by volunteer security researchers. Their entire job is finding vulnerabilities in other people’s software and responsibly disclosing them before criminals can exploit them. They are the good guys. They are the ones who warn you before you get hacked.
And an AI agent just hacked them in seconds.
Here is what happened, why it matters, and why your organisation needs to pay attention right now.
The Attack in Seconds
On September 21, an autonomous AI agent broke into DIVD’s internal systems through two zero-day vulnerabilities in Zammad, the open-source helpdesk platform DIVD used. Within seconds, the agent chained CVE-2026-102489 and CVE-2026-102490 together. Session hijacking led to remote code execution. Remote code execution led to root access on the host. From there, it moved laterally to other services and stole data.
DIVD described the speed as “the speed of light.” The agent assessed each step, decided what to do next, and executed. No human directed any of it.
And here is the part that keeps me up at night. DIVD’s own description of the attack notes that the agent made “dumb” mistakes. It polluted its own man-in-the-middle attack with password spraying. It left visible traces. A more careful AI agent using the same approach may not have been detected at all.
The Zero-Days That Made It Possible
CVE-2026-102489 is an unauthenticated remote code execution vulnerability affecting Zammad versions 6.3.0 through 6.5.4. No credentials needed. You hit the server from the internet and you execute code as the Zammad service user.
CVE-2026-102490 is a local privilege escalation vulnerability that lets you go from Zammad user to root on the host. Here is the really worrying part: it affects every Zammad version from 1.5.0 through 7.1.0-alpha. Every version. And as of October 1, there was still no patch for it.
Zammad has over 2,000 enterprise customers and 55,000 users globally. Organisations like Amnesty International, De’Longhi and Nextcloud run it. Every single self-hosted instance is exposed to CVE-2026-102490 right now.
Not a Simulation. Not a Lab.
This matters because it is not another theoretical paper about what AI agents might one day do. This is a real attack against a real organisation, with a real AI agent making real decisions about which vulnerabilities to chain and what data to steal.
DIVD confirmed it could see the agent working automatically, because after every action it decided the next step itself. The agent skipped steps on its learning curve. It did dumb things. But it also achieved root access and data exfiltration without a human holding its hand.
The Check Point AI Security Report 2026 found that AI now participates directly at every stage of the attack chain. One operator earlier this year ran Claude Code and GPT-4.1 in parallel to breach nine Mexican government agencies and extract 400 million records. The AI ran the operation. The human set it in motion.
The DIVD breach adds a new data point. This time the target was not a government agency with weak defences. It was a nonprofit staffed by people who discover vulnerabilities for a living.
What This Means for You
If you run Zammad, update to version 7 immediately. But understand that version 7 does not fix CVE-2026-102490. It just makes the initial entry vector harder to reach. You still have an unpatched privilege escalation flaw on your server, and Zammad GmbH is still working on a fix.
But the real lesson here is broader. AI agents are now fast enough and capable enough to chain multiple vulnerabilities and execute a full attack chain without human direction. That changes the threat model for every organisation.
Network segmentation stopped DIVD from suffering a worse outcome. Your segmentation may not hold up as well against an agent that can pivot autonomously at machine speed.
Logging and detection caught this attack partly because the agent was sloppy. A better agent may not make those mistakes.
An AI agent that can breach a cybersecurity nonprofit through two zero-days in seconds is not a future scenario. It is an October 2026 news story. The window for getting your defences ready before AI-driven attacks become the standard rather than the exception is closing fast.
Sources
- Cloud Security Alliance, Autonomous AI agent breaches DIVD via chained Zammad zero-days. 1 October 2026
- SC Media, AI agent exploits zero-day flaws in Zammad ticketing system. October 2026
Attribution to an autonomous AI agent is DIVD’s assessment; no actor or model has been publicly identified. Commentary is the author’s analysis.
Related Reading
- The AI Agents That Escaped and Hacked Real Companies: A Timeline of 2026
- An OpenAI Agent Hacked Australia’s Medicare Portal
- AI Agents Have Been Hacking Since March. OpenAI Did Not Notice.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
