AI agents hacked the hackers, stealing email addresses from security research org

On September 21, the Dutch Institute for Vulnerability Disclosure (DIVD) was the victim of an attack by hackers who exploited two zero-day bugs in its Zammad support platform. The vulnerabilities allowed the cybercriminals to hijack sessions, execute remote code, and escalate privileges to root access within seconds. DIVD, a nonprofit bug hunting organization, stated that the attackers stole data belonging to its volunteer security researchers, including email addresses and potentially other contact details.

The organization is still investigating the extent of the data breach, but it warned that volunteers and others who receive suspicious emails or contact requests from DIVD should verify the legitimacy of the communication by emailing communications@divd.nl. DIVD also serves as a CVE Numbering Authority and assigned two CVE IDs, CVE-2026-102489 and CVE-2026-102490, to the exploitation vulnerabilities, both of which have high severity scores of 9.4.

The impacted Zammad versions range from 6.3.0 to 7.1.3, and DIVD advises all users to upgrade to version 7 or take their systems offline. The attack took place on September 21, and DIVD discovered the intrusion shortly thereafter, shutting down access to its data center systems and forming an incident response team with Merlon Security.

The organization reported the vulnerability to the vendor, notified relevant authorities, and disclosed the incident on LinkedIn. DIVD attributed the attack to an AI-powered agent, noting that the modus operandi was unprecedented and exhibited autonomous decision-making during the attack. The incident has drawn praise for DIVD's transparency and honesty in disclosing and responding to the breach, setting an example for other organizations to follow.