An autonomous AI agent exploited two previously unknown vulnerabilities in Zammad and gained access to the network of the DIVD, the Dutch vulnerability disclosure organisation

From session hijacking to root access in a matter of seconds: the DIVD describes an intrusion carried out by an agent who decided on each step independently, acting swiftly but in a very haphazard manner.

The Dutch Institute for Vulnerability Disclosure (DIVD), an association of volunteer researchers responsible for reporting vulnerabilities, was the victim of an intrusion on September 21 that it attributes, along with the company Merlon Security, to an autonomous AI agent. The attacker chained two previously unknown vulnerabilities of Zammad, an open source support and ticketing software: CVE-2026-102489, which allows code to be executed via session hijacking (versions 6.3.0 to 6.5.4), and CVE-2026-102490, a local elevation of privilege that affects all versions from 1.5.0 to 7.1.0-alpha. The transition to the root account took a few seconds.

Fast, but messy

Several clues point to an agent: non-deterministic actions chained together at machine speed, commented scripts that explain themselves what they do, and a password spray attack that disrupted its own network interception attempt. The DIVD describes it as "noisy and very messy." The theft of the volunteers' email addresses was confirmed on October 1; other data (contact information, tickets, Jira and Confluence spaces) may have been exfiltrated.

The code execution flaw is fixed from version 7.2.0, but no patch existed yet at the beginning of October for elevation of privilege. The recommendations: update or cut Zammad, isolate the support service by blocking outgoing traffic by default, keep the logs and pass the indicators of compromise script published by the DIVD.