A Dutch group that warns other firms about exposed systems has become its own case study. The Dutch Institute for Vulnerability Disclosure, or DIVD, says intruders broke into its network. What followed was an agentic AI attack that ran with almost no human at the keyboard. Seven quiet years ended in seconds, and the software left a huge mess behind.
How the agentic AI attack unfolded
DIVD described the break-in as loud and very, very messy. That sounds like faint praise until you weigh the alternative. The agent picked each action on its own, at machine speed. It also left running notes that explained its reasoning as it worked.
The running commentary turned into evidence for the defenders. Because the agent explained itself so fully, DIVD could rebuild the whole sequence later. Its volunteers ended up with a clear record of nearly every step. Few teams get that kind of gift after a break-in.
The agent also made errors that no skilled human would make. At one point it ran a password spraying routine. That routine broke its own adversary-in-the-middle setup. DIVD judged the tools behind the agentic AI attack to be poorly trained and badly set up.
Two Zammad zero-days opened the door
The way in was Zammad, an open-source helpdesk tool. Support teams use it to handle customer requests and IT tickets. DIVD found two unknown flaws in it, now tracked as CVE-2026-102489 and CVE-2026-102490. Chained together, they allowed session hijacking, remote code execution, and a jump from a normal account to root.
That whole chain ran in seconds rather than hours. Speed is the real story here, because the agentic AI attack automated work a human would have done by hand. The attacker then read and copied data from DIVD systems. Network design and a fast response stopped the agent from going deeper.
What Zammad admins should do now
DIVD found the flaws with help from Merlon Security and told the vendor before going public. The group is also warning owners of exposed servers it can spot. Anyone running Zammad should move to version 7, which DIVD treats as safe. Taking the server offline is the other option until that upgrade lands.
Zammad says it serves more than 2,000 customers and 55,000 users. So the risk reaches far past one Dutch nonprofit. Support desks hold ticket histories, contact details, and often credentials, which makes them useful ground for an agentic AI attack.
Machine speed resets the clock for defenders
For years, security teams worked with a comforting assumption about time. Attackers had to probe, pivot, climb, and then judge what was worth stealing. All of that took hours or days. An agentic AI attack squeezes the same work into the space of a coffee break.
Network segmentation is what kept this case from getting far worse. The agent touched several services, but it could not burrow deeper into the network. A quick response then shut the door behind it. Plain, unglamorous controls did the heavy lifting here.
The next agentic AI attack probably won’t be loud
Everything DIVD knows here comes down to one fact: the tooling was bad at hiding. A better agent would skip the chatty notes and throttle its own pace. It would also avoid the clumsy password spraying that gave the game away. So the real question is what a quiet agentic AI attack would do to a target with weaker monitoring.
Criminal tools improve fast once a method proves it works. Phishing automation went from novelty to commodity in about two years. Nothing suggests attack agents will take any longer to mature. Defenders should plan for the version that stays silent.
What this means for everyday users
Most readers do not run a ticketing server, but the lesson still lands. The same automation that powers an agentic AI attack on company systems also scans home networks for open services and reused passwords. Patching early, using a password manager, and turning on two-factor logins break those chains fast. Each step costs little and buys real time.
A VPN helps by shrinking what an automated scanner can see in the first place. It encrypts your traffic and hides your real IP address. That keeps your home network off the target lists these tools build. A VPN will not patch a flawed server, but it does cut the surface that machine-speed scanning can map.
Final Thoughts
DIVD got a rough lesson in a threat it has spent years helping others avoid. The group handled the aftermath with unusual openness. DIVD told the police, the Dutch data protection authority, and the national cyber security centre. It then published what it found while the investigation was still live.
That openness gives the industry a rare look at how an agentic AI attack behaves inside a live network. Most victims never share this much. The next group to face one may not get such a talkative opponent.
