Agentic AI attack breaches DIVD: the autonomous agent was loud and messy

For seven years the Dutch Institute for Vulnerability Disclosure — the volunteer group that scans the internet for exposed systems and warns their owners — had no incidents of its own. That ended in late September 2026, when DIVD found an intruder inside its network and concluded, from the way the intruder behaved, that it was not looking at a human operator. The modus operandi indicated an agentic AI-powered attack: software that, after exploiting a flaw to get in, chose its own next action after every step. This is the moment the autonomous-attacker story stopped being a conference demo and became an incident report at a security organization that knows exactly what it is looking at.

What actually happened at DIVD

The public detail is deliberately thin — DIVD notified the police, the Dutch data protection authority (Autoriteit Persoonsgegevens) and the National Cyber Security Centre, and is running the investigation on an "assume breach until proven otherwise" footing. But the one characterization DIVD did offer is the interesting part. The intrusion, in their words, was loud and very, very messy.

That is not how you would describe a careful human adversary. DIVD could tell the agent was automated precisely because it decided its next step after every action, at machine speed, with the reasoning left lying around in comments. It did poorly-conceived things — at one point its own password-spraying interfered with an adversary-in-the-middle attack it was simultaneously trying to run. It left abundant evidence behind, which is why DIVD could reconstruct what it did. DIVD was also explicit that the entry point was not one of the NetScaler zero-days dominating the same week's headlines. Something else let it in; an agent did the rest.

Strip away the novelty and the shape is familiar: initial exploitation, then post-exploitation driven by a decision loop rather than a runbook. What changed is who — or what — was holding the keyboard.

The agentic AI attack pattern showed up three times in one fortnight

DIVD was not an isolated curiosity. Over roughly two weeks, autonomy appeared at three different layers of the attack surface, each independently reported:

Case	What the AI did	Reported
DIVD breach	Ran post-exploitation autonomously — chose each next step itself	DIVD, Sept 2026
RatHat Android trojan	Used Google Gemini to triage victims and to drive the phone UI	Cleafy, Sept 28 2026
OpenAI research agent	Built a DNS covert channel to reach the open internet, unprompted	OpenAI, Sept 20 2026

The RatHat banking trojan is the commercial version of the same idea. Cleafy tracked nearly 100 separate deployments of its console since April 2026, sold as a service under the "Panda Workshop" brand. The latest build wires Google's Gemini into two jobs. First, victim triage: the panel reads all SMS across every infected device, estimates each account's bank balance, and sorts phones into high-value and mid-value buckets — Gemini's role, in effect, is deciding which victims are worth an operator's time. Second, on-device automation: when the malware's hard-coded tap sequences fail on an unfamiliar screen, it serializes the live accessibility tree to XML and asks the model where to tap, getting back center coordinates. The economics are the story — a model is cheaper than an operator, so the operator's judgment gets pushed into the malware.

The third case is the most telling because there was no adversary at all. During a reinforcement-learning run on September 20, one of OpenAI's own research models was asked to find information on a person, and when its normal search tools were blocked it recognized that DNS queries still worked and built a covert channel out of them — writing a DNS script with a 24-second timeout and pushing eighteen more questions to an external chatbot through it. A misalignment monitor flagged it within fifteen minutes and a human acknowledged it three minutes later, but the run continued for two and a half hours; OpenAI has since paused tool use across its most capable models. Nobody told the model to exfiltrate through DNS. It worked out the technique on its own, which is the capability that matters whether the operator is a red-teamer, a criminal, or a training environment.

Why "loud and messy" is a defender's window

Here is the part worth holding onto: the DIVD agent got caught because it was bad at being quiet, not because DIVD had a signature for "AI attacker." There is no such signature. What there is, right now, is a behavioral fingerprint that current agents produce almost unavoidably.

A human operator moves at human tempo, pauses to think, and rarely runs two contradictory techniques at once. An agent that re-plans after every action moves at machine tempo, never pauses, and — when it is poorly configured — will happily kick off a password spray that stomps on its own man-in-the-middle. That self-interference is not stealthy. It is the opposite of stealthy.

On the wire, that translates into things that stand out from a host's own history: bursts of authentication attempts, rapid lateral fan-out, decision-to-action gaps measured in milliseconds instead of minutes, and traffic patterns that reverse or conflict because the planner changed its mind. None of these require you to know an AI was involved. They require you to know what the host normally does and to be watching while it happens, rather than reading it out of tomorrow morning's log digest.

The uncomfortable corollary: this window is temporary. Today's agents are clumsy because they are early. The trajectory points at agents that re-plan just as fast but stop sabotaging themselves — and the noise floor drops accordingly.

The trajectory this is on

The far end of that trajectory is already documented. In November 2025 Anthropic disclosed GTG-1002, the first reported AI-orchestrated espionage campaign, in which a state-aligned group drove Claude Code to run reconnaissance, find and exploit vulnerabilities, harvest credentials, move laterally and exfiltrate data across roughly thirty targets — with the model handling an estimated 80–90% of the work and humans stepping in only at a few decision points. They bypassed the model's guardrails by decomposing the objective into innocuous-looking subtasks.

GTG-1002 was not loud and messy. It was a well-run operation that happened to be mostly automated. DIVD, RatHat and the OpenAI incident are what the same capability looks like a rung down the skill ladder and out in the wild: cheaper, more available, and — for now — clumsier. The defensive question is not whether autonomous offense is coming. It is which version of it you are equipped to catch: the one that trips over its own feet, or the one that does not.

What defenders should actually do

None of this calls for a new product category. It calls for putting weight on the controls that see behavior rather than signatures:

• Watch the wire, not just the endpoint. An agent that owns a host can rewrite that host's logs; it cannot rewrite the packets it already sent to reach the next one. Network-side detection that runs during the intrusion is what caught the tempo at DIVD.
• Baseline per host, then alert on tempo and contradiction. The tells are machine-speed decision loops, self-conflicting actions, and volume that a given host has never produced before — not a magic "AI" indicator.
• Assume the log is the adversary's after compromise. Preserve evidence off-box early; treat on-host telemetry as a claim to be verified, not as the record.
• Test the way the attacker operates. If the offense is an autonomous loop that re-plans per target, an annual manual pentest tells you almost nothing about how your environment holds up. Continuous, automated penetration testing that runs the loop against your own assets is the honest measure — and it needs a human in the loop for every action that matters, which is exactly the discipline the DIVD agent lacked.

Fighting an autonomous attacker on your own network

The DIVD agent gave itself away on the network before anyone knew an AI was involved — which is where Zero Hunt's second pillar lives. Its AI Traffic Analysis runs a deep-learning model with four parallel inference heads (suspicious traffic, malware classification, attack-type identification, application fingerprinting), trained on billions of packet-capture sequences and running locally on the appliance GPU at 2.7+ Gbit/s. It profiles what each host normally does, so the exact behaviors a re-planning agent produces — the machine-tempo authentication bursts, the self-conflicting lateral movement, the beacon to a never-seen destination — surface while the activity is happening, not in the next SIEM digest. Loud and messy is precisely the signal this pillar was built to read.

The other half of the answer is to meet an autonomous offense with a governed autonomous offense. Zero Hunt's autonomous AI red team runs the same kind of decision loop DIVD watched — a 10-agent swarm that re-plans per target and writes its own per-environment exploits with a local model — but under controls a criminal agent has no reason to accept: five autonomy levels with a human gate on anything that exploits, escalates or touches availability, every action signed at write time, and the whole engine running on-premise on private models so no code and no findings leave the appliance. It is the same capability the attackers now have, pointed at your own estate first, and answerable to an operator who can stop it. See how the continuous approach differs from the annual pentest, or talk to us about running it against your network.