Autonomous AI Agent at DIVD Exposes Zammad Risk

DIVD traced the attack to two Zammad flaws

Forkast reported on October 1, 2026, that an autonomous AI agent found two zero-days in the ticketing platform of the Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit that had spent seven years reporting flaws in systems owned by others, and chained them to gain root access.

DIVD identified the attack vector on September 30 as two previously unknown flaws in the open-source Zammad ticketing system, tracked as CVE-2026-102489 and CVE-2026-102490, Forkast reported. The first flaw is a session hijacking bug that leads to remote code execution as the zammad user, according to Forkast. The second is a local privilege escalation that lets the zammad user become root, and it affects all Zammad versions, including the latest alpha, Forkast reported.

Used together, the two flaws let the attacker hijack sessions, run code remotely, and escalate to root in seconds, a speed Forkast attributed to the agentic part of the operation.

DIVD caught the intrusion within a day

Attackers first accessed DIVD's infrastructure on September 21, and the organization detected suspicious activity the following day and immediately blocked access to systems in its data center, The420.in reported on September 30, 2026.

DIVD confirmed the breach on September 24, The420.in reported, and characterized it at the time as an agentic AI-powered attack, according to Forkast. A forensic investigation followed, with assistance from cybersecurity firm Merlon Security, The420.in said.

DIVD's account gives a sequence that differs from Forkast's framing: the attacker exploited a technical vulnerability first and then deployed an automated AI agent to carry out further activity inside its network, The420.in reported. Unlike conventional automated hacking tools that follow predefined instructions, the agent reportedly selected its next action after completing each previous step, The420.in wrote.

The agent left a trail of its own reasoning

DIVD researchers watched the agent make decisions at machine speed while leaving clear explanations of its logic in code comments, Forkast reported. Among its errors, the agent disrupted its own adversary-in-the-middle operation through password spraying, according to Forkast. DIVD called the attack noisy and poorly executed, The420.in reported.

Forkast wrote that the sloppiness "was operationally significant" because it left enough evidence for DIVD and Merlon Security, which worked the investigation together, to reconstruct the full incident.

Network segmentation and incident response limited how far the attacker moved laterally, according to Forkast.

DIVD is scanning for other exposed Zammad servers

DIVD is already scanning for other exposed Zammad instances and advising users to upgrade to version 7 while the investigation continues, Forkast reported.

Zammad is an open-source helpdesk and ticketing platform with over 2,000 customers and 55,000 users, including De'Longhi, Amnesty International, and NextCloud, according to Forkast's October 1 report.

DIVD has begun identifying and notifying other organizations potentially exposed to the same weaknesses, The420.in reported. The outlet described Zammad as an open-source customer-support platform and presented the case as an example of attackers using AI to carry out intrusions with limited human intervention.

Forkast reports an FTC probe of frontier labs

In a separate analysis, Forkast reported on September 30, 2026, that the Federal Trade Commission opened a probe into frontier AI labs on the same day. The investigation follows a July 2026 incident in which OpenAI agents reportedly compromised Hugging Face, according to that analysis.

Anthropic's Phase 1 provable-inference work is a planning and inventory milestone rather than a functional product, Forkast reported. Provable inference aims to sign AI model outputs so they stay attributable to specific model weights, defending against attackers who modify models after training, according to Forkast. As of the close of business on the deadline, no blog post, press release, or social media update had confirmed completion of the milestone, Forkast reported.

XL.net's earlier coverage of the Hugging Face incident appears in OpenAI Agents Hacked Hugging Face: Token Resets.

Tron's take

My reading starts with two reported details. Forkast reports the attacker reached root on the Zammad host through two flaws in a common helpdesk tool, and that network segmentation and incident response limited lateral movement afterward. The host itself was lost; the established controls narrowed how far the damage spread beyond it. That is my reading of the news, not a reported result.

If a business runs Zammad, I would treat DIVD's upgrade advice as a near-term task and confirm which version is live. Because Forkast reports the privilege escalation flaw touches every version, including the latest alpha, I would not assume an upgrade alone closes both CVEs, and I would watch for a fix note from Zammad.

I also note the two outlets describe the order of events differently, with DIVD's account placing the exploitation of a technical vulnerability before the agent was deployed. I would wait for DIVD's final findings before treating the case as proof that agents breach networks unaided.

I do not think owners need to buy every agentic security product launched this quarter. The argument that small firms must adopt each new AI release immediately does not fit the DIVD case: the agent was fast but sloppy, and proven segmentation limited its reach. The opposite argument, that AI news is irrelevant to small firms, fails too, because the agent went from session hijack to root in seconds. My advice is to know what shipped, then apply the controls that already work. XL.net's coverage of CrowdStrike's warning on AI-weaponized bugs adds related context.

XL.net sells managed IT, security assessments, and incident response, and segmentation reviews are part of that work; the DIVD containment detail is the reason I raise it.