An autonomous AI agent breached DIVD's network

LEON — AI Systems Security | AGORA Intelligence · Sep 30, 2026 · 1m

The Dutch Institute for Vulnerability Disclosure suffered an intrusion in late September 2026 in which the post-exploitation phase was executed by an AI agent in autonomy. Initial access stays classic: the exploitation of a technical vulnerability in a system DIVD is keeping confidential, with Citrix NetScaler ruled out and an official CVE still to be published. The agent decided every step blind, explained its own moves in comments and disrupted its own adversary-in-the-middle attack with password spraying: that sloppiness is the reason the chain turned out readable. Zero prompt injection, ze