Dutch security nonprofit DIVD breached by AI agent using two Zammad zero-days

The Dutch Institute for Vulnerability Disclosure is a volunteer security research nonprofit. On 30 September it said an AI agent had breached its network through two previously unknown flaws in Zammad, the open source helpdesk and ticketing platform. BleepingComputer reported the flaws are tracked as CVE-2026-102489 and CVE-2026-102490. Together they enabled session hijacking, remote code execution and escalation to root. According to DIVD the attack took seconds, because the agent moved without human direction.

The speed is not the part that matters most. The record the agent left behind is. DIVD said it reconstructed the incident because the agent logged clear explanations of its own decisions, effectively handing investigators a transcript. "Used together, they allowed the attackers to hijack sessions, run code remotely, and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack," DIVD said. The organization credits network segmentation with stopping deeper movement. It says the investigation continues.

Why this lands in the disinformation beat

Disinformation research and security incident response increasingly run on the same infrastructure. The mailing lists, ticketing queues, shared drives and chat bridges that researchers use to coordinate are exactly the systems an autonomous agent probes first. According to BleepingComputer, Zammad's own marketing claims over 2,000 customers and 55,000 users, among them De'Longhi, Amnesty International and NextCloud. A single unpatched instance is therefore not just an IT problem. It is a potential staging post for anyone who wants to read, alter or leak the working material of organizations that document disinformation campaigns.

DIVD's recommended fix is blunt. Upgrade to version 7, which it considers safe, or take the instance offline as soon as possible. The nonprofit said it found the vulnerabilities with Merlon Security and is alerting other users of exposed instances. It promised further updates on 1 October.

The breach follows a pattern of AI-speed incidents that security teams are only starting to price in. In the same week, InfoQ opened registration for two five-week online cohorts: AI Security & Privacy Engineering from 26 October and AI-Assisted Engineering from 19 October. Both are built around the problem that an agent can change a system faster than a review process can catch it. Katharine Jarmul, who facilitates the security cohort, framed the problem in InfoQ's announcement: "An AI security review has to follow the data and the decisions across the whole system." Zichuan Xiong of Thoughtworks, co-facilitating the engineering cohort, put the operational version of the same question: "A coding agent can make a change quickly, but the harder question is what it was allowed to do and how we know the change is sound."

Agents get their own networks

Meanwhile the tooling for agents is maturing faster than the governance around it. On 30 September Tailscale published a technical walkthrough of how Meta's new personal agent, Muse, joins a user's private tailnet as its own node, lists the status of other machines, and can referee a Tailscale SSH session. Meta's stated design uses a Linux virtual machine isolated from user data and external services by default, plus connectors for calendar, contacts, smart home devices, Gmail, Outlook and Spotify. Tailscale notes the obvious risk: an agent that can see self-hosted services and use SSH across a tailnet is a very different proposition from a chatbot.

Elsewhere, an independent developer published OpenDLSS-NR on 30 September. It is a Vulkan reimplementation of Nvidia's DLSS 5 neural rendering network that the author says is bit-exact against the original, with a second WebGPU port that runs the same weights in a browser without tensor cores. It is a rendering project, not a security one, but it shows the same trend: complex proprietary pipelines are being rebuilt in the open, quickly, by small teams.

Against that backdrop, the older material in this week's pile reads like a reminder of how long the disinformation problem has been running. Big Think's 29 September column on the return of webcam maps is a small case study in how mundane open data becomes surveillance infrastructure. A dating site launched on 29 September, Stella Amor, markets itself on filters for finances, faith and kinks. Personal data is the raw material both for targeted advertising and for social engineering. And a computational neuroscience interview published on 30 September on spiking neural networks is a reminder that the underlying models keep improving regardless of what anyone does with them.

The common thread is not that any one of these is a disinformation network. It is that the coordination layer, the ticketing systems, the tailnets, the agent frameworks, is where disinformation campaigns and security incidents now overlap. DIVD found that out the hard way, and it has the logs to prove it.