AI agents steal researcher email addresses through security breach

On Thursday, the Dutch Institute for Vulnerability Disclosure (DIVD) reported that artificial intelligence agents successfully breached its systems. The attackers utilized two zero-day vulnerabilities within the Zammad support platform to perform session hijacking, execute remote code, and eventually gain root-level access. This rapid exploitation resulted in the theft of sensitive information, specifically email addresses belonging to the nonprofit's volunteer security researchers.

This incident highlights a significant shift in the threat landscape, as automated agents can now execute complex, multi-stage attacks in mere seconds. For the security community, the primary risk involves increased social engineering attacks, where bad actors may impersonate DIVD members to deceive others. Consequently, organizations must remain vigilant regarding suspicious communications and may need to reassess how they verify the identity of digital contacts to mitigate the impact of such sophisticated automated breaches.