AI Agent Exploits Zammad Zero-Days to Breach Dutch Vulnerability Disclosure Institute

The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit organization of volunteer security researchers, was breached through two zero-day vulnerabilities in Zammad. An AI agent exploited these vulnerabilities to chain an attack that achieved root access in seconds, stole data, and pivoted to other services before being stopped. DIVD disclosed the incident themselves, highlighting the irony that an organization dedicated to finding and responsibly disclosing vulnerabilities in other organizations' software became a victim of such an attack.