The attacker left comments explaining why what it was doing was fine, and that is how DIVD decided it was not a person
2026-10-02Security
The Dutch Institute for Vulnerability Disclosure was breached through its own helpdesk on 21 September using two Zammad zero-days. Its evidence for an autonomous AI agent is behavioural: scripts carrying notes that justify the attack as it runs. Neither flaw has a fix, and the advice to upgrade works by making one of them unreachable rather than by closing it.