Zammad

An AI agent reportedly chained together multiple zero-day vulnerabilities in Zammad to compromise systems run by DIVD, the Dutch Institute for Vulnerability Disclosure, in a matter of seconds. The incident highlights how autonomous AI tools can exploit unpatched security flaws faster than defenders can respond, raising fresh concerns about agentic hacking and the exposure of helpdesk software to automated attacks.

An AI agent broke into the network of DIVD, the Dutch Institute for Vulnerability Disclosure, operating autonomously and choosing its own steps as it went. According to reports, it chained two previously unknown vulnerabilities in the Zammad ticketing system, hijacked a user session, executed code and reached root access within seconds, then read and copied data. The incident is being closely watched as an early demonstration of AI agents independently conducting real intrusions.

The Dutch Institute for Vulnerability Disclosure (DIVD) reports that zero-day vulnerabilities in the open-source ticketing platform Zammad were exploited to carry out a network breach driven by artificial intelligence. The incident highlights concerns about attackers combining unpatched software flaws with AI tooling. No further details about victims or the extent of the intrusion were provided in the coverage.