DIVD says autonomous AI agent breached its network

The Dutch Institute for Vulnerability Disclosure (DIVD), a nonprofit of volunteer security researchers, says an autonomous AI agent breached its network. The organization described the attack as “loud and very, very messy.”

DIVD scans the internet for systems affected by known vulnerabilities, notifies their owners and shares information on mitigating risks. It said the intrusion came after seven years of uneventful operations. The attack’s purpose and impact remain unclear while an investigation continues.

According to DIVD, the attacker exploited a technical vulnerability in an undisclosed system. The organization said the system was not Citrix NetScaler. The agent then carried out post-exploitation activity, choosing its next actions autonomously. DIVD said it interfered with its own adversary-in-the-middle attack through password spraying, and left comments that over-explained its decisions. The organization believes the agent was poorly trained and configured for the task.

DIVD said it has informed the police, the Dutch data protection authority, Autoriteit Persoonsgegevens, and the National Cyber Security Center (NCSC). It withheld further details to avoid affecting the investigation or putting other potential victims at risk. The organization said it would provide a more detailed update on October 1 and notify other possible victims when it can. BleepingComputer said it contacted DIVD for details about the vulnerability and its patch status but had not received a response by publication.