# Agentic AI used for post-exploitation in breach of the Dutch Institute for Vulnerability Disclosure (DIVD)

> The Dutch Institute for Vulnerability Disclosure (DIVD), a volunteer-run security nonprofit, disclosed a breach in which an unidentified attacker exploited a technical vulnerability in an undisclosed system and then used an autonomous agentic AI for post-exploitation, including password spraying and an adversary-in-the-middle operation. DIVD called the intrusion 'loud and very, very messy'. The scope of compromised data is not yet established.

- **Published:** 2026-09-29T00:00:00Z
- **Last reviewed:** 2026-09-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2793
- **ID:** TL-2026-2793
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-09-24 (23:34 CEST) DIVD's CSIRT published 'It was a matter of when, not if…', disclosing that it had noticed suspicious activity in its infrastructure, concluded a breach had occurred, blocked access to its infrastructure, and engaged an external incident response team for forensics. DIVD said this was the first breach it had suffered in nearly seven years of operation, and that it was treating the incident as a worst-case scenario, assuming compromise until proven otherwise.

Initial access: according to DIVD (as reported by BleepingComputer, DataBreaches.net and Beinsure), the actor exploited a technical vulnerability in an undisclosed system. DIVD stated the vulnerability is not Citrix NetScaler. No CVE, product name or vendor has been published; DIVD is withholding details to avoid influencing the investigation and to protect other potentially affected victims, which it plans to notify.

Post-exploitation: DIVD stated 'This is an attack we have not seen before. Not because it's our first, but because the modus operandi indicates that this is an agentic AI-powered attack.' Evidence indicates the agent chose its next action after each previous step rather than following a pre-scripted sequence. It operated quickly but with sloppy logic, performed password spraying while simultaneously running an adversary-in-the-middle operation (thereby interfering with its own AiTM activity), and left comments explaining many of its actions in the code it produced. The intrusion was unusually noisy and left substantial forensic evidence. DIVD suggested the agent appeared poorly trained or configured for offensive security work.

Response and status: DIVD reported the incident to the Autoriteit Persoonsgegevens (Dutch data protection authority) and the NCSC, and consulted/informed the police. Directly affected parties were notified. Whether data was accessed, stolen or altered is unconfirmed. The actor's identity, the vulnerable product and the exact affected systems are undisclosed. No IOCs (IPs, domains, hashes) were published. DIVD's initial notice scheduled an update for 2026-09-28; reporting on 2026-09-29 cites a further detailed update promised for 2026-10-01. Severity is an analyst estimate pending confirmation of impact.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1110.003 Password Spraying
- T1557 Adversary-in-the-Middle
- T1059 Command and Scripting Interpreter
- T1588.007 Obtain Capabilities: Artificial Intelligence

## Sources

- [Automated AI agent used to breach cybersecurity nonprofit DIVD (BleepingComputer)](https://www.bleepingcomputer.com/news/security/automated-ai-agent-used-to-breach-cybersecurity-nonprofit-divd/)
- [It was a matter of when, not if… (DIVD CSIRT)](https://csirt.divd.nl/2026/09/24/when-not-if/)
- [DIVD Dutch Institute for Vulnerability Disclosure investigating agentic AI-powered attack (DataBreaches.Net)](https://databreaches.net/2026/09/25/divd-dutch-institute-for-vulnerability-disclosure-investigating-agentic-ai-powered-attack/)
- [DIVD says AI agent carried out cyberattack through software flaw (Beinsure)](https://beinsure.com/news/divd-says-ai-agent-carried-out-cyberattack-through-software-flaw/)
- [DIVD reports suspected agentic-AI breach (ai-hack-watch issue #36)](https://github.com/agnivesh/ai-hack-watch/issues/36)
- [Dutch Institute for Vulnerability Disclosure (Wikipedia)](https://en.wikipedia.org/wiki/Dutch_Institute_for_Vulnerability_Disclosure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2793