The cyberattack against the Dutch Institute for Vulnerability Disclosure, or DIVD, may represent one of the clearer real-world examples yet of an AI agent being used autonomously during an intrusion. DIVD says an attacker exploited a technical vulnerability in one of its systems and then deployed an agentic AI system that operated inside the environment, evaluating the results of each action and deciding what to do next without requiring a human operator to manually issue every command. The organization described the activity as exceptionally fast, highly automated, and also remarkably messy, leaving behind enough evidence for investigators to reconstruct much of the attack.

That distinction matters because there is a substantial difference between an attacker using ChatGPT to write commands and an autonomous agent conducting post-exploitation. Traditional automation follows predefined logic: run command A, parse the result, then execute command B according to rules written in advance. An agentic system can instead observe the environment, reason about what it sees, choose the next action dynamically, execute it, evaluate the outcome, and continue iterating. DIVD says that is what its investigators observed during this incident.

The incident began with exploitation of an undisclosed technical vulnerability. DIVD has deliberately withheld details because its investigation is still active and disclosure could place other organizations using the same vulnerable technology at risk. The organization has specifically stated that the affected technology was not Citrix NetScaler, presumably to prevent speculation linking the incident with the recently disclosed NetScaler zero-days. DIVD says it intends to notify other potentially affected organizations before releasing detailed technical information.

That restraint is particularly important because the vulnerability appears to provide the initial entry point. The AI did not magically discover some metaphysical gap in the Internet and materialize inside DIVD. There was still a conventional security weakness that enabled initial compromise. AI became significant after the attacker obtained access, where it appears to have automated reconnaissance and subsequent exploitation decisions.

The likely conceptual attack chain therefore looks like:

technical vulnerability exploited → attacker gains initial access → autonomous AI agent deployed → environment reconnaissance → agent interprets results → next action selected automatically → credentials and systems probed → post-exploitation continues at machine speed

The important innovation is concentrated in the middle of that chain.

DIVD described the attack as “loud and very, very messy.” Investigators could apparently see the agent repeatedly carrying out actions, processing what happened, and selecting its next move. The agent even left verbose comments explaining some of its reasoning, providing investigators with unusually direct evidence of how the automation operated.

That is both technically interesting and operationally revealing.

Human attackers normally attempt to minimize unnecessary activity once inside a valuable target. Every command creates telemetry. Every authentication attempt can generate an alert. Every process execution becomes another forensic artifact.

The AI agent apparently behaved differently.

It moved quickly but made poor decisions, generated substantial noise, and sometimes interfered with its own attack.

DIVD reported one particularly illustrative example in which the agent was conducting an adversary-in-the-middle attack while simultaneously performing password spraying, with the password-spraying activity interfering with its own AitM operation.

That is hardly Skynet.

But it should not make defenders comfortable either.

An inexperienced human attacker can make the same mistakes, but a machine can make them much faster and against far more systems simultaneously.

This is the central security implication of agentic offensive tooling: competence and speed are independent variables.

An agent does not need to be brilliant to become dangerous.

It merely needs enough capability to automate repetitive decisions faster than defenders can investigate them.

A mediocre attacker operating manually might spend hours enumerating systems, trying passwords, examining responses, changing tactics, and documenting results.

An AI agent can compress parts of that workflow into minutes.

Even if a significant percentage of its decisions are poor, the sheer number of actions it can attempt creates a new operational challenge for defenders.

This changes the economics of cyberattacks.

Historically, sophisticated hands-on-keyboard intrusions required skilled operators who could interpret network information, understand authentication systems, pivot between hosts, and adjust techniques when something failed.

That expertise created a natural bottleneck.

One experienced attacker could actively operate only a limited number of intrusions at once.

Agentic systems potentially reduce that constraint.

A human operator may be able to assign objectives to multiple agents simultaneously while the agents perform routine discovery, testing, credential validation, and lateral-movement attempts independently.

The attacker then becomes more like a supervisor than a keyboard operator.

This does not remove humans from the attack.

It changes where human attention is spent.

Instead of manually entering every command, the human can focus on selecting victims, setting goals, reviewing results, and intervening when the automation reaches a difficult decision.

That is a much more plausible near-term evolution of offensive AI than the dramatic idea of a completely autonomous system independently deciding whom to hack.

DIVD’s incident also demonstrates another consequence: machine-speed attacks shorten defender response windows.

Traditional SOC processes are often built around human-scale timelines. An alert is generated, enters a queue, gets triaged, escalated, investigated, and eventually contained.

That can take tens of minutes or even hours.

An autonomous attacker can perform hundreds or thousands of actions during that interval.

The defensive question therefore changes from:

“Can we detect this?”

to:

“Can we detect and contain this before the next fifty actions happen?”

That distinction becomes increasingly important.

Detection without rapid containment may provide an excellent forensic record of the organization being compromised in real time, which is educational but not especially comforting.

The DIVD attack therefore strengthens the argument for automated defensive response under carefully defined conditions.

If one identity suddenly begins enumerating hundreds of internal systems, spraying passwords, establishing proxy infrastructure, and performing abnormal authentication activity at machine speed, security platforms should be capable of automatically restricting that identity or isolating the affected host before a human analyst finishes reading the alert.

Such controls need safeguards because automated defensive systems can themselves disrupt legitimate operations.

But attackers are increasingly automating faster than many organizations are prepared to respond.

That asymmetry will become difficult to ignore.

The incident also provides an important reminder about logging.

DIVD was able to recognize the agentic behavior precisely because the attack left extensive telemetry. The agent’s noise, rapid sequencing, repeated actions, and explanatory comments provided forensic material.

Organizations without centralized authentication logs, endpoint telemetry, network records, process creation history, and application logs may experience the same kind of attack without realizing that the attacker was operating autonomously.

Agentic attacks may have detectable behavioral signatures.

Examples could include unusually rapid transitions between reconnaissance and exploitation, repeated action-observation-action loops, parallel experimentation with multiple techniques, excessive command execution, and unusual persistence in retrying failed approaches with slight variations.

Those patterns differ somewhat from tightly scripted malware and disciplined human hands-on-keyboard activity.

Over time, defenders may be able to build analytics specifically around this type of behavior.

The “sloppy logic” DIVD observed is also important from a threat-research perspective.

Current AI agents can misunderstand context.

They can pursue contradictory actions.

They can repeat failures.

They can over-explain.

They can make incorrect assumptions.

Yet none of those weaknesses prevents them from becoming useful offensive tools.

Cybersecurity has a long history of successful attacks built with imperfect automation.

Internet worms do not reason elegantly.

Credential-stuffing bots do not demonstrate strategic brilliance.

Mass vulnerability scanners are not intellectually impressive.

They are effective because they operate continuously and at scale.

Agentic AI introduces a more adaptable layer on top of that same principle.

The danger is therefore not necessarily that the AI is smarter than the defender.

The danger is that it can keep trying things without getting tired, bored, distracted, or needing coffee, a design flaw humanity has somehow failed to patch in itself.

DIVD’s own response is also worth noting.

After identifying the breach, the organization isolated its infrastructure, initiated a forensic investigation with an external incident-response team, notified directly affected parties, reported the incident to the Dutch Data Protection Authority and the Netherlands National Cyber Security Centre, and consulted law enforcement. DIVD says it is handling the situation under a worst-case assumption until forensic analysis can establish the actual scope.

That “assume breach until proven otherwise” approach is appropriate when the attacker has already demonstrated autonomous post-exploitation capability.

Investigators will need to establish not only what the AI agent did, but what credentials, tokens, data, or systems it may have reached during its experimentation.

Because the agent performed many actions automatically, reconstructing intent may be harder than with a traditional intrusion.

A human attacker’s sequence of commands often reflects a reasonably coherent plan.

An AI agent may explore several paths simultaneously, abandon some, return to others, and perform actions that even the operator did not explicitly request.

Incident-response teams may therefore need to distinguish three different questions:

What did the attacker instruct the agent to achieve?

What actions did the agent independently choose?

Which of those actions actually succeeded?

That is a new forensic challenge.

Logs no longer necessarily represent a human adversary making deliberate decisions one command at a time.

They may represent a system exploring possibilities on behalf of a human objective.

Attribution may become harder as well.

An AI agent’s tool choices, wording, command structure, and even operational mistakes may reflect the model or framework rather than the human operator behind it.

Traditional behavioral attribution based on command syntax or operator habits may therefore become less reliable when large portions of an intrusion are generated by standardized AI systems.

This does not make attribution impossible.

Infrastructure, victimology, initial-access techniques, malware, credentials, payment trails, and other evidence still matter.

But analysts will need to be careful about treating AI-generated tradecraft as a reliable fingerprint of the human threat actor.

Another key lesson is that agentic attacks do not eliminate conventional cybersecurity fundamentals.

DIVD was initially compromised through a technical vulnerability.

If that vulnerability had not been exploitable, the AI agent would never have received its playground.

This matters because discussion around AI attacks can become distracted by the futuristic part of the story.

The practical defensive controls remain familiar:

patch exposed systems, minimize attack surface, enforce strong identity controls, segment networks, protect privileged accounts, centralize logs, monitor lateral movement, and contain suspicious behavior quickly.

AI changes the speed and adaptability of what happens after failure.

It does not abolish the need to prevent the initial failure.

The incident also illustrates why vulnerability disclosure becomes more complicated when autonomous exploitation exists.

Once a vulnerability becomes available to agentic systems, those systems could theoretically scan, test, exploit, and continue post-exploitation without waiting for a human operator to manually integrate the vulnerability into a toolchain.

That can shorten the interval between disclosure and exploitation even further.

Security teams may therefore need to assume that newly disclosed vulnerabilities can be operationalized extremely quickly.

DIVD itself understands this problem particularly well because its normal mission is to scan the Internet for vulnerable systems and notify owners before criminals exploit them. Being targeted by an automated attacker is therefore a rather grim demonstration of the same scaling principle from the opposite side.

The organization has said it plans to provide more detailed technical information on October 1, once it can do so without jeopardizing the investigation or increasing the risk to other vulnerable organizations.

Until then, several key questions remain unanswered.

The vulnerable product has not been named.

The attacker has not been attributed.

The full impact is unknown.

DIVD has not yet publicly confirmed whether sensitive information was exfiltrated.

And the exact AI model or agent framework used in the attack has not been disclosed.

Those uncertainties should remain explicit.

What can already be said with reasonable confidence is that DIVD observed behavior it believes is consistent with an autonomous agent conducting post-exploitation, rather than ordinary scripted automation.

That is significant because it provides another example of cyberattacks moving toward a hybrid model:

human objective → AI agent planning → automated action → machine interpretation of results → next action chosen autonomously → human oversight only where necessary

The broader cybersecurity lesson is not that autonomous AI has suddenly replaced hackers.

It has not.

The more immediate development is potentially more practical and therefore more consequential:

one hacker may increasingly be able to supervise many autonomous attackers at once.

The DIVD incident also offers a useful warning for defenders who take comfort from the fact that current offensive agents remain clumsy.

A clumsy human attacker works slowly.

A clumsy AI attacker can be clumsy thousands of times per hour.

That changes the defensive equation.

The real race is therefore becoming less about whether attackers or defenders have access to AI.

Both will.

The real question is which side can observe, decide, and respond faster once the attack begins.

The Dutch Institute for Vulnerability Disclosure (DIVD) suffered an AI-driven cyberattack that the organization described as "loud and very, very messy." [...]

Source: Automated AI agent used to breach cybersecurity nonprofit DIVD via Bleeping Computer — published 29 Sep 2026.