An AI agent chained two zero-days: the seconds that took down DIVD

An organisation that helps other people handle vulnerabilities was taken over by vulnerabilities. In early October, DIVD — the Dutch Institute for Vulnerability Disclosure — was confirmed to have been breached, and the attacker was an autonomous AI agent.

The shape of the chain

The public write-up is blunt: an AI agent chained two Zammad zero-days and took over DIVD’s systems in seconds.

Zammad is a widely used ticketing and customer-support system. ThaiCERT issued an alert about a Zammad zero-day on 4 October describing the consequence as “system takeover” with privilege escalation to root.

This was not a single-point exploit but a chain: two zero-days strung together to walk from initial access to root. DIVD’s own case number is DIVD-2026-00014.

Why “seconds” is the story

The security world has mature language for how bad a single vulnerability is. “Chained exploitation completed in seconds” is a different thing.

Doing a chain by hand costs roughly this:

• Read both advisories and understand the trigger conditions.
• Decide whether they compose, and in what order.
• Write the exploit and handle environment differences.
• Debug until it works.

For any team that is hours to days of work, and it requires someone fluent in both mechanisms. An AI agent compresses the judgement and the debugging into machine time.

The danger is not that AI finds a zero-day. It is that it chains the two you were planning to combine later, right now.

The defender’s clock changed

Vulnerability disclosure rests on an implicit assumption: between patch release and mass exploitation there is a buffer for defenders to apply it.

The length of that buffer used to be set by how much human labour an attacker needed. Now it is set by how many attempts an agent needs.

DIVD exists precisely to shorten defenders’ response time. When it gets taken out by a second-scale chained attack, the message is that the two sides are no longer operating on the same timescale.

My take

I do not read this as zero-days becoming easier to find. Those two Zammad bugs existed; who finds them first is a matter of probability.

What changed is the exploitation phase. Finding a vulnerability takes insight. Chaining them takes engineering judgement — and that is far easier to automate, because the inputs and outputs are well defined: an entry point, a target, intermediate conditions. What remains is search.

So defence has to move with it: plan patch windows in hours rather than weeks, and treat internet-exposed administrative systems as already living under a chained-exploitation assumption.

As for an agent deciding to attack on its own, the public record so far shows it executed quickly. It does not show any autonomous intent. Treating it as an extremely fast, extremely patient operator is closer to reality than treating it as a new species.