There's a special kind of irony when the people who report security holes for a living get breached through a security hole. Now add a twist: no human hacker was at the keyboard. An AI agent was, making its own decisions and, by all accounts, crashing around like a raccoon in a kitchen.

Two Zero-Days and an AI Agent

The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit that warns organizations about exposed vulnerabilities, was breached on September 21, 2026. The attackers got in through two previously unknown flaws in Zammad, the popular open-source helpdesk and ticketing system. DIVD says the attack bears the marks of agentic AI. After every action, the agent picked its next step itself, "at the speed of light," with what DIVD called "sloppy logic." DIVD summed up the attack as "loud and very very messy."

The two bugs were a bad pairing. CVE-2026-102489 (CVSS 9.4) lets an unauthenticated attacker run code remotely and leak user sessions on Zammad 6.3.0 through 6.5.4. CVE-2026-102490 (CVSS 9.4) lets a low-privilege user escalate to root on every Zammad version. Chained together, they took the attacker from no access to root in seconds. The agent then moved on to other services and exfiltrated data. Network segmentation stopped it from going deeper.

Messy Doesn't Mean Harmless

It's tempting to laugh at a clumsy robot burglar. But the "messy" part is the only reason this was caught quickly: DIVD's automated monitoring noticed the noise. A machine that chains two critical zero-days in seconds doesn't need to be elegant. It needs to be fast, and it was. Expect the next one to be quieter.

What's often overlooked is the boring hero of this story: network segmentation. It didn't keep the attacker out, but it limited how far they could go. Meanwhile, the Dutch NCSC's advice to back up application and network logs before patching is a reminder that incident response is also about evidence. DIVD's recommendation is blunt: upgrade to Zammad 7 or take it offline. There's no complete fix yet for the privilege-escalation bug.

The attackers have AI agents now, and AI agents never take a lunch break. Your segmentation, monitoring, and patch habits need to be just as tireless.

Your helpdesk, CMS modules, and every other third-party tool you run are part of your attack surface, so grab our free developer security checklist and audit what you're trusting by default.

Source: Help Net Security