Automated AI agent breached cybersecurity nonprofit DIVD

The Dutch Institute for Vulnerability Disclosure (DIVD) reported an AI-driven attack in which an autonomous agent exploited a technical vulnerability and chose its own next steps. The nonprofit notified police, the Dutch data protection authority and NCSC, and will publish more details on October 1.

• DIVD says it suffered its first agentic AI-powered attack
• The agent exploited a vulnerability and ran post-exploitation autonomously
• DIVD notified police, Autoriteit Persoonsgegevens and NCSC
• A fuller incident update is promised for October 1