The Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit organization that reports vulnerabilities to the organizations responsible for addressing them, disclosed on September 24, 2026 that its infrastructure had been breached. According to DIVD, the observed modus operandi indicated an agentic AI-powered attack.
DIVD said it detected suspicious activity, investigated the activity, blocked access to its infrastructure, and launched a forensic investigation with a third-party incident response team. It also reported the incident to the Dutch Data Protection Authority and the National Cyber Security Centre (NCSC), and consulted with law enforcement about its options.
At the time of its September 24 statement, DIVD had not disclosed whether a specific technical vulnerability had been exploited or whether an AI agent had been used during post-exploitation activity. The investigation was still ongoing. The characterization of the incident as agentic AI-powered was DIVD's own assessment based on the observed modus operandi. DIVD said it was treating the situation as a worst-case scenario and assuming a breach until proven otherwise.
This blog examines what DIVD has publicly stated, what the reported modus operandi could mean, and the defensive lessons organizations can take from the incident.
1. What DIVD disclosed
DIVD has described its approach to the incident as open, transparent, and honest. In its newsroom statement and a subsequent update, DIVD reported that a technical vulnerability in an undisclosed system was exploited as the initial entry point and specifically stated that the system was not Citrix NetScaler.
DIVD later reported that an automated AI agent was used during post-exploitation activity. The organization has not disclosed the identity or patch status of the vulnerability while the investigation continues, explaining that withholding those details helps avoid influencing the investigation and reduces the risk to other potential victims. DIVD said it would notify organizations that may have been exposed to the same vulnerability.
DIVD initially said its next public update would follow on September 28, while a later update provided additional details on October 1. No threat actor has been publicly identified. DIVD has also presented the characterization of the incident as an agentic AI-powered attack as an assessment based on the observed modus operandi, rather than as an independently confirmed fact.
2. What an agentic AI attack means
An agentic AI attack refers to an attack in which an AI-powered software agent can autonomously perform actions and determine subsequent steps after an initial foothold. According to DIVD, the agent decided what to do next after each action, operating at high speed and displaying what the organization described as sloppy logic or recognizable patterns.
What makes the incident notable, based on DIVD's account, is that the automated agent appears to have performed post-exploitation activity and selected subsequent actions rather than simply following a fixed sequence of predefined commands. However, the publicly available information does not establish from DIVD's September 24 statement alone that the agent carried out the full hands-on-keyboard activity traditionally associated with a skilled human operator. It also does not establish that the agent escalated privileges, moved laterally, or searched for data.
DIVD has said its investigation into exactly what the agent did and the full impact of the intrusion is still ongoing.
3. Why a messy attack would still be serious
DIVD was candid in its later reporting about the agent's behavior, describing it as making some “pretty dumb” decisions. These reportedly included password spraying that interfered with its own adversary-in-the-middle attack, with DIVD characterizing the overall activity as loud and messy.
These details come from later reporting and updates rather than DIVD's September 24 statement, so they should not be presented as part of the original disclosure. The reported mistakes also do not mean the attack was less serious. If the later reporting is retained, any claim that the agent's behavior left evidence that helped investigators understand the incident should likewise be attributed to that later account.
A noisy or error-prone agent may generate more observable activity for defenders, but the available information does not establish that such behavior necessarily makes an attack easier to detect. The later account also describes the agent as operating at high speed and making its own decisions about what to do next. According to DIVD, the agent was associated with post-exploitation activity, while the investigation into what the agent did, how the attack unfolded, and its full impact remained ongoing.
4. The defensive lessons the incident supports
The DIVD incident is an openly documented example of an attack in which an AI agent was reported to have been involved during the post-exploitation phase. The defensive lesson is straightforward: an AI agent still needs an initial access path, and identifying and closing exploitable weaknesses can reduce the opportunities available to an attacker.
The publicly available information does not establish that the agent specifically escalated privileges or moved laterally, so those actions should not be presented as confirmed facts. The incident also illustrates why organizations need to assess not only whether vulnerabilities exist, but whether they can actually be exploited.
That is where vulnerability assessment and penetration testing can help by identifying and validating exploitable weaknesses. Red teaming can go further by testing how security controls respond after an initial compromise.
Neither approach can prevent every agentic AI attack, and no security assessment can guarantee that. What they can do is reduce the number of exploitable paths available to an attacker and help organizations identify weaknesses before they are used.
DIVD has said it is learning from an attack it did not want and has chosen to share its experience openly so others can learn from it. The organization stated that it is “learning a lot from this type of attack.” The incident reinforces the importance of isolating affected infrastructure, conducting a thorough investigation, and identifying and closing exploitable weaknesses.
If you're looking to assess your organization's exposure to similar risks, Scan your organization's exposure, explore Laburity, or book a consultation.
