The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit staffed by volunteer security researchers, experienced a breach last week carried out by an automated AI agent. The organization, which had operated without incident for seven years before this attack, characterized the intrusion as "loud and very, very messy" due to the volume of evidence left behind.
DIVD's mission centers on scanning internet-connected infrastructure for exposure to known vulnerabilities, reaching out to affected organizations, and offering remediation guidance. The breach investigation remains ongoing, with the organization having notified law enforcement, the Autoriteit Persoonsgegevens (the Dutch data protection authority), and the National Cyber Security Center (NCSC).
The attack began when a threat actor exploited a technical vulnerability in an undisclosed system—specifically not Citrix NetScaler, DIVD clarified—before deploying an AI agent to conduct post-exploitation operations. The organization withheld certain details to protect the integrity of the investigation and prevent additional victims from being targeted.
DIVD stated that "This is an attack we have not seen before. Not because it's our first, but because the modus operandi indicates that this is an agentic AI-powered attack." The organization elaborated on the agent's behavior, noting that "The attack itself was loud and very very messy. We could see the agent working automated, because after every action it decided the next step itself, at the speed of light and sloppy logic or pattern."
The autonomous agent exhibited significant operational deficiencies during its time on DIVD's network. Researchers observed that the AI performed "some pretty dumb things," including sabotaging its own man-in-the-middle attack through password spraying activities. The agent's decision-making process was accompanied by verbose commentary that revealed its reasoning, and DIVD concluded the system had been inadequately trained and configured for the task at hand.
The poor execution and extensive forensic artifacts left by the agent enabled DIVD researchers to reconstruct the incident's timeline and mechanics. The organization committed to releasing a comprehensive incident report on October 1 and pledged to contact other potential victims of the same vulnerability as quickly as possible. The ultimate objectives and scope of the attack remain unclear as the investigation continues.