AI Agent Breached Security Nonprofit in Seconds
The Dutch Institute for Vulnerability Disclosure says an autonomous AI agent breached its network by chaining two previously unknown vulnerabilities in the open-source Zammad ticketing system, moving from initial access to root privileges in seconds.
Key facts
Who was breached: DIVD, a Dutch nonprofit of volunteer security researchers
The flaws: CVE-2026-102489 and CVE-2026-102490 in Zammad, an open-source helpdesk and ticketing platform
What they allowed: Session hijacking, remote code execution, and privilege escalation from the Zammad user to root
The attacker: An AI agent that moved autonomously and chose its next steps without external direction
The fix: Upgrade to Zammad version 7, or take the instance offline
Scale of exposure: Zammad says it has over 2,000 customers and 55,000 users
What happened?
DIVD previously described the attack as loud and very, very messy, driven by an AI agent operating on its own. The organization has now identified how the agent got in: a chain of two zero-day vulnerabilities in Zammad.
Used together, the flaws let the attacker hijack sessions, run code remotely, and escalate privileges from the Zammad user account to root — in seconds, which DIVD attributes directly to the agentic nature of the attack. Root is the highest level of access on a Linux system; an account with it can do anything.
After exploiting the vulnerabilities, the attacker accessed other services and read and exfiltrated data from DIVD's systems.
How did DIVD reconstruct the attack?
Because the AI agent explained itself. DIVD retrieved extensive details about the incident because the agent left behind clear explanations of its decisions, allowing the organization to reconstruct what happened.
That is an unusual gift to defenders and a genuinely new forensic situation. A human attacker covers their tracks. An AI agent working through a task narrated its reasoning into the logs.
How bad was the damage?
Contained, for now. DIVD says network segmentation and its incident response stopped the attacker from moving deeper into the network. The investigation is ongoing, and DIVD has promised further updates.
Network segmentation is the practice of dividing a network into isolated sections so that compromising one does not grant access to the rest. It is the control that worked here — worth noting, because it is one of the few defenses that functions regardless of how fast the attacker moves.
What should Zammad users do?
Upgrade to version 7, which DIVD considers safe, or take the instance offline as soon as possible. DIVD discovered the flaws with Merlon Security, notified Zammad, and is alerting users running vulnerable instances.
Zammad lists customers including De'Longhi, Amnesty International and NextCloud. Because it is available self-hosted, many organizations run instances their security teams may not have inventoried.
Why this incident matters
A support ticketing system is exactly the kind of software that sits outside most organizations' idea of critical infrastructure — until it turns out to be internet-facing with a path to root.
The speed is the other lesson. Detection and response processes built around human attacker tempo assume you have hours. DIVD's segmentation held because it was already in place, not because anyone reacted in time.
Sources: BleepingComputer; DIVD's disclosure.