The Dutch Institute for Vulnerability Disclosure, a nonprofit staffed by volunteer security researchers, said an autonomous AI agent was used in a cyberattack on its own infrastructure. It is the first successful intrusion the organisation has suffered in almost seven years.

The evidence examined so far indicates that a human or automated attacker exploited a technical vulnerability in a system DIVD has not named, and then used an AI agent to carry out the post-exploitation work: password spraying and an adversary-in-the-middle attack. DIVD has stated specifically that the vulnerability was not related to Citrix NetScaler, which had been suggested in early coverage.

The interesting detail is how visible it was

DIVD describes the attack as loud and messy, leaving behind extensive evidence, and says this suggests an agent that was poorly trained or poorly configured. That is a small observation with a large implication for defenders.

An empty corridor in a modern office building
The organisation had gone nearly seven years without a breach. Illustrative photo. Max Vakhtbovych · pexels · Pexels License

A human intruder spends effort on being quiet, because being caught costs them. An agent spends effort on completing the task, and quietness is only instrumental if the prompt made it so. The result is an attacker that moves fast, tries many things and documents its own work — which is easier to detect and far easier to reconstruct afterwards.

That advantage is temporary. It holds only while operators are not asking for stealth.

Canal houses in a Dutch city
A fuller update was promised for 1 October. Illustrative photo. Adrien Olichon · pexels · Pexels License

Who has been told

DIVD has notified the police, the Dutch data protection authority and the national cyber security centre. The investigation is active, and the organisation has not disclosed the full scope or the purpose of the attack. It said it would publish a fuller update on 1 October.

The target is worth noting. DIVD exists to find vulnerabilities and tell the affected parties privately, which means it holds knowledge of unpatched flaws in other people’s systems. Whether that was the objective is exactly what the forthcoming update should address.

What to watch

The 1 October update, and specifically whether DIVD names the exploited system and says what the attacker was looking for.