Artificial intelligence is changing how we search, work, create, and interact with the internet.
But what happens when AI starts making decisions during a cyberattack?
That question became more real in September 2026, when the Dutch Institute for Vulnerability Disclosure (DIVD) reported that its systems had been compromised through vulnerabilities in Zammad, an open source customer support platform.
According to DIVD’s investigation, the attack showed evidence of an agentic AI system autonomously carrying out parts of the intrusion. The attack involved two vulnerabilities that could be chained to enable session hijacking, remote code execution, and privilege escalation.
The incident raises an important question for the cybersecurity industry:
What happens when an attacker doesn’t need a human directing every step?
What Happened?
On September 21, 2026, DIVD discovered that its infrastructure had been compromised.
During the investigation, researchers identified two previously undisclosed vulnerabilities affecting Zammad:
- CVE-2026-102489: a vulnerability that could allow unauthenticated remote code execution and session leakage.
- CVE-2026-102490: a privilege escalation vulnerability that could allow a low privileged Zammad user to gain root level access.
The vulnerabilities could be combined to move from initial access toward deeper control of an affected system.
The Dutch National Cyber Security Centre subsequently warned that both vulnerabilities were being actively exploited and urged affected organizations to update their Zammad installations.
But the vulnerabilities weren’t the only unusual part of the incident.
DIVD said its investigation indicated that the attacker was an agentic AI system capable of making decisions during the attack rather than simply following a fixed sequence of instructions.
What Is an Agentic AI Attack?
Most people are familiar with AI systems that respond to prompts.
You ask a question.
The AI responds.
Agentic AI is different.
An agent can be designed to pursue a goal by:
- Observing its environment
- Deciding what action to take
- Taking that action
- Evaluating the result
- Choosing its next step
In cybersecurity, that could potentially mean an AI system discovering a vulnerability, testing an attack path, responding to what it finds, and continuing toward its objective.
That’s very different from an automated script that simply performs the same instructions repeatedly.
And that’s what makes agentic AI particularly interesting and concerning for cybersecurity.
How Did the Attack Work?
The Zammad incident involved two vulnerabilities that could be chained together.
The first vulnerability could provide a path to remote code execution and potentially expose user sessions.
The second could allow a compromised low privileged account to escalate its permissions to root.
In simplified terms, the attack chain looked something like this:
Vulnerability → Initial access → Session compromise → Privilege escalation → Greater system control
This is why security researchers often look at how vulnerabilities can be combined rather than considering each flaw separately.
A vulnerability that seems manageable on its own can become considerably more serious when paired with another weakness.
Why Is AI Making This Different?
Cyberattacks already use automation.
Attackers have automated vulnerability scanning, password attacks, phishing campaigns, and other repetitive tasks for years.
The difference with agentic AI is decision making.
A traditional automated tool might be told:
Scan these systems.
An agentic system could potentially be given a broader objective and determine which steps to take based on what it discovers.
That could allow attacks to become more adaptive.
If a particular approach doesn’t work, the system could potentially try another.
If it discovers a new piece of information, it could potentially use that information to decide what to do next.
This doesn’t mean AI can automatically break into every system.
It means the potential scale and speed of cyber operations are changing.
Is AI Now Replacing Hackers?
Not exactly.
It’s important not to overstate what this incident proves.
DIVD attributed the attack to an agentic AI based on its investigation, but the available public evidence does not independently establish every detail of that attribution beyond dispute. The underlying exploitation of the Zammad vulnerabilities, however, is documented, and the vulnerabilities were confirmed as being actively exploited.
So the takeaway isn’t that human hackers are becoming obsolete.
Instead, AI could become another tool attackers use to make their operations faster, more scalable, and potentially more adaptive.
Why This Matters for Businesses
For businesses, the biggest concern may be speed.
Security teams need time to identify vulnerabilities, understand attacks, investigate unusual activity, and respond.
An automated attacker doesn’t necessarily have the same limitations.
If AI systems can operate continuously and make decisions at machine speed, the window between a vulnerability being discovered and being exploited could become smaller.
That makes several security practices even more important:
- Keep software and systems updated.
- Monitor unusual account and network activity.
- Limit privileges so compromised accounts cannot access everything.
- Use strong authentication and MFA.
- Segment sensitive systems.
- Have a response plan ready before an incident occurs.
The goal isn’t simply to prevent every attack.
It’s to make it harder for one compromised component to become a much bigger breach.
What Does This Mean for Everyday Internet Users?
You don’t need to run enterprise software to be affected by the evolution of cyberattacks.
The services you use every day depend on large amounts of software and infrastructure operating behind the scenes.
A vulnerability in a customer support platform, cloud service, authentication system, or other piece of infrastructure can potentially affect the organizations and services connected to it.
For everyday users, the fundamentals still matter:
Keep Your Devices Updated
Security updates often address vulnerabilities that attackers are actively trying to exploit.
Use Strong Authentication
Enable MFA wherever it is available, particularly for email, financial accounts, and other important services.
Be Careful With Unexpected Login Requests
Attackers can use compromised accounts and convincing messages to trick users into handing over additional credentials.
Use Privacy and Security Tools Wisely
A VPN can help protect your internet traffic from local network observers and mask your IP address, but it isn’t a replacement for device security, software updates, or account protection.
Security works best when multiple layers work together.
The Bigger Picture: AI vs. AI
There is another side to this story.
The same technology that can potentially help attackers can also help defenders.
Security teams are already using AI to analyze large volumes of security data, identify suspicious behavior, discover vulnerabilities, and assist with incident response.
That creates a new cybersecurity race:
AI assisted attacks vs. AI assisted defense.
The advantage may not come from simply having the most powerful AI.
It may come from having the right safeguards around it.
Organizations will need to think carefully about what AI systems can access, what actions they can perform, and when human approval should be required.
What Can You Do to Stay Safer?
AI driven attacks may sound like an enterprise problem, but the best defense still begins with basic security hygiene.
Here are a few steps worth taking:
- Keep your operating system, browser, and apps updated.
- Use unique passwords for important accounts.
- Turn on MFA.
- Avoid clicking unexpected login or verification links.
- Review which applications have access to your accounts and data.
- Use trusted networks or a VPN when connecting over unfamiliar Wi-Fi.
- Don’t assume that a security tool alone makes you completely protected.
The goal isn’t to become impossible to hack.
It’s to reduce the number of opportunities an attacker has.
FAQs
DIVD reported that its systems were compromised on September 21, 2026 through two vulnerabilities in Zammad. The vulnerabilities could be chained to enable remote code execution, session compromise, and privilege escalation.
DIVD’s investigation concluded that an agentic AI system was responsible for the intrusion and described autonomous decision making during the attack. However, the public evidence does not independently prove every aspect of that attribution, so the AI component should be understood as DIVD’s assessment rather than an uncontested fact.
Agentic AI refers to AI systems designed to pursue goals by observing information, making decisions, taking actions, and adapting based on the results rather than simply responding to individual prompts.
No. AI does not automatically give an attacker access to every computer or network. Successful attacks still depend on vulnerabilities, access, permissions, configurations, and other factors.
Businesses should keep software patched, use strong authentication, restrict privileges, monitor systems for unusual activity, segment sensitive infrastructure, and maintain an incident response plan. Security teams should also consider how AI could change the speed and scale of future attacks.
A VPN can improve privacy by encrypting traffic between your device and the VPN server and masking your IP address from websites you visit. However, a VPN does not prevent vulnerabilities in software, phishing, malware, compromised accounts, or attacks against the services you use. It should be considered one layer of a broader security strategy.
Final Thoughts
The Zammad incident is significant because it points toward a possible change in how cyberattacks are carried out.
For years, automation helped attackers perform repetitive tasks faster.
Agentic AI could take that a step further by allowing systems to observe, decide, adapt, and act with less human involvement.
The technology is still developing, and individual claims about AI involvement need to be evaluated carefully.
But one thing is clear: cybersecurity is entering an era where the attacker may not always be a person sitting behind a keyboard.
And if AI can help automate the attack, defenders will need to become just as good at automating the defense.
The future of cybersecurity may not be humans vs. machines. It may be machines helping humans on both sides of the fight.
