DIVD Hit by Agentic AI-Powered Cyberattack

• •DIVD experienced a significant breach from an agentic AI-driven attack.
• •The attack was described as 'loud and very messy,' indicating poor execution by the AI.
• •DIVD is actively investigating the incident and has involved law enforcement and data protection authorities.

The Dutch Institute for Vulnerability Disclosure (DIVD) reported a cyberattack attributed to an agentic AI, marking a significant breach after seven years of operation without incident. The attack was characterized as 'loud and very, very messy,' with the AI agent autonomously executing actions that left substantial evidence for investigation. DIVD has initiated a forensics investigation and informed relevant authorities, including the police and the National Cyber Security Centre. The exact impact and purpose of the attack remain unclear, but it exploited a technical vulnerability in an undisclosed system, which has not been identified as Citrix NetScaler. DIVD is treating the situation as a worst-case scenario and is focused on securing its infrastructure and supporting its volunteers. A public update is expected on October 1, 2026.