Dutch nonprofit DIVD says an autonomous AI agent ran the attack that breached it
A security nonprofit watched an AI agent carry out a messy break-in step by step, a preview of the noisy automated attacks defenders now need to spot.
The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit run by volunteer security researchers, says it was breached in an attack in which an autonomous AI agent carried out the work after the initial break-in, according to a report by BleepingComputer on 29 September 2026. DIVD first disclosed the intrusion late last week, noting that it had operated for seven years without such an incident, and shared more detail on Monday.
The attacker got in through what DIVD called a technical vulnerability in a system it has not named. The organisation specifically said the entry point was not Citrix NetScaler. Once inside, an automated AI agent handled the post-exploitation steps. DIVD described the attack as loud and very messy, and said its responders could watch the agent working because after every action it chose the next step on its own, quickly and with sloppy logic.
That sloppiness showed in the detail. According to DIVD, the agent ran password spraying that interfered with its own man-in-the-middle activity, and it left extensive comments explaining its reasoning. DIVD said the agent appeared poorly suited to the job.
DIVD has reported the incident to local police, the Dutch data protection authority (Autoriteit Persoonsgegevens) and the National Cyber Security Centre. It has not said what data, if any, was taken, and it held back some details to protect the investigation. It promised a fuller update on 1 October and said it would notify other organisations exposed to the same vulnerability.
Why it matters
This is one of the first public accounts from a victim that describes an AI agent running the hands-on part of an intrusion. The agent was clumsy, but it worked at machine speed and did not need a skilled operator at the keyboard. That lowers the cost of attacking many targets at once. It also changes what defenders look for, because an agent's noise, pace and self-narration leave traces that a careful human would not.
This is one of the first public accounts from a victim that describes an AI agent running the hands-on part of an intrusion.
Initial access
The attacker exploited a technical vulnerability in an undisclosed system, which DIVD says was not Citrix NetScaler.
AI agent takes over
An automated AI agent carried out the post-exploitation work, choosing each next step itself.
Noisy, self-defeating actions
Its password spraying interfered with its own man-in-the-middle activity, and it left comments explaining itself.
Reported to authorities
DIVD notified local police, the Dutch data protection authority and the National Cyber Security Centre.
Update due 1 October
DIVD promised more detail and said it would warn other organisations exposed to the same vulnerability.
What you can learn from this
- Initial access and post-exploitation are separate jobs. Most intrusions have a phase where the attacker gets a foothold, followed by a phase where they explore, collect credentials and move to other systems. The first phase often relies on one specific vulnerability, while the second is a repeatable routine of commands and decisions. That routine is exactly the kind of work an AI agent can be pointed at, which is why DIVD saw a human-chosen entry point followed by automated follow-up. Defences therefore need to cover both: patching to deny the foothold, and internal monitoring to catch what happens next.
- How password spraying works and why it is noisy. Password spraying tries a small number of common passwords against many accounts, rather than many passwords against one account. The aim is to stay under per-account lockout limits while still finding someone who chose a weak password. It leaves a distinctive trail: one source generating failed logins across many different usernames in a short window. That pattern is easy to spot in authentication logs if anyone is counting, which is one reason DIVD could see the agent at work.
- Man-in-the-middle positions inside a network. A man-in-the-middle attack places the attacker between two parties so traffic passes through them, letting them read or alter it. Inside an office or server network this is often achieved by answering name or address lookups that were meant for another machine. The technique needs a stable, quiet position to be useful. DIVD's account that the agent's own spraying interfered with this activity shows an automated attacker working against itself, because noisy actions can break the conditions a stealthy one depends on.
- Agents narrate, and narration is evidence. Language model agents typically plan in text, and some tools write that reasoning into files, command comments or logs as they go. DIVD said the agent left extensive comments explaining itself. For defenders this is a gift: the reasoning trail can reveal what the attacker wanted and which systems it considered. It also suggests that retaining detailed command and process logs is more valuable than ever.
- Reporting duties shape the response. Under the EU's General Data Protection Regulation, an organisation must tell its data protection authority about a personal data breach, generally within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. That is why notices to the Autoriteit Persoonsgegevens appear early in incident timelines. Telling police and a national cyber centre is separate and helps others defend against the same technique.
We teach this in the AI Tutor
How to use this in practice
- Look for spraying in your own logs. On a Linux machine you run, try sudo journalctl -u ssh --since "7 days ago" | grep "Failed password" (the unit may be named sshd on some systems). Count how many different usernames each source address tried. Done is a short list of any address that failed against three or more usernames, and a decision about whether to block it.
- Write a tiny spraying detector. Take that log output and write a Python or shell script that groups failures by source address and counts distinct usernames within a ten-minute window. Print any address that crosses a threshold you choose. Done is a script that runs in under a minute and flags a test case you create by failing to log in as three made-up users from one machine.
- Check your own accounts against the spraying pattern. Open the security settings for your main email, code hosting and cloud accounts. Confirm that multi-factor authentication is on, and that none of them uses a password a sprayer would try first, such as a season and year. Done is every important account on a unique password stored in a password manager, with a second factor enabled.
- Draft a one-page incident contact sheet. Write down who you would tell if a project or small business you run were breached: in Australia the Office of the Australian Information Commissioner and the Australian Cyber Security Centre, in the EU your data protection authority, plus your hosting provider and any affected users. Add the deadlines you are aware of. Done is a single page saved where you would find it in a stressful hour.
Sources
Our reporting is an original summary. Full coverage is at the links above.
How do you score in Cybersecurity?
A few minutes of questions, then a report on where you stand and what to learn next.