The trend analysis in our Hugging Face breach & the new era of autonomous cyberattacks has stopped being a prediction. In the span of two weeks this autumn, security reporting has documented two first-of-their-kind agentic AI intrusions: an autonomous attack on the Dutch Institute for Vulnerability Disclosure (DIVD) in which an AI agent operated end-to-end and exploited two Zammad zero-days, and the deployment of Artex — an LLM-orchestrating framework — against South Korean banks. This isn't AI-assisted phishing anymore. It's AI holding the keyboard against production systems.
For years, "AI attacks" meant generated lures at scale: better spear-phishing, faster reconnaissance, synthetic voices. Useful, but the decisions stayed human. What changed in September–October 2026 is structural — the loop from target selection to exploit execution to persistence closed without a human in it. Below: what actually happened in both incidents, why agentic attacks break the defender calculus, and the controls that still work when your opponent never sleeps.
Case #1: DIVD — When the Vulnerability Disclosure Board Becomes the Victim
There's a bitter irony in the first confirmed agentic AI breach landing on an organization whose entire mission is finding and fixing vulnerabilities. DIVD — the Dutch Institute for Vulnerability Disclosure, the volunteer collective behind coordinated disclosure of thousands of Dutch CVEs — was hit on September 21, 2026 by an attack that security coverage describes as an agentic AI operation: an AI-driven agent chaining two zero-day vulnerabilities in Zammad, the open-source ticketing and support platform.
The target choice is itself a lesson. Zammad is exactly the kind of software every organization runs but nobody treats as attack surface — a customer-facing ticket portal, internet-reachable, authenticated by humans, integrated with email and internal systems. In the AI-operations model, that's ideal: a rich environment where an agent can register, interact, probe, and escalate with its traffic indistinguishable from ordinary helpdesk noise. The lesson generalizes brutally: your business software — ticketing, CRM, admin portals — is the new perimeter, and it's exactly where autonomous agents will look first. We flagged the same drift in our Cisco ISE CVSS 10.0 zero-day retrospective: identity and management plane appliances have quietly become the most valuable real estate on the network.
The mechanics matter more than the irony. The agent didn't need one perfect exploit — it chained two independent zero-days, adapting as it went. That's the signature of agentic attacks: not a flashier exploit, but a loop that discovers, verifies, chains, and pivots at machine speed. A human operator running the same chain would have left breathing room in every step for a SOC to notice. An agent closes those gaps.
Case #2: Artex — Off-the-Shelf LLMs, Orchestrated Against Banks
The second incident shows the other half of the threat model. Reporting on October 6, 2026 described hackers using Chinese AI agents to breach South Korean banks — with the attacks running on Artex, an AI cybersecurity framework attributed to a Chinese developer. Here's the twist that should worry every CISO: Artex isn't a model. It was designed as a defensive toolkit for finding network vulnerabilities, and it works by orchestrating existing commercial models — Claude Opus, ChatGPT, and DeepSeek — into automated attack workflows.
Read that again: the attack engine was built out of the same LLMs enterprises are deploying for customer support and code review. The dual-use problem isn't hypothetical anymore — the orchestration layer is the weapon, and it assembles itself out of your approved vendor list. The same pattern appeared in this summer's Salesbleed zero-click prompt injection analysis: enterprise AI agents are an attack surface that trusts the very language channel attackers control. Artex demonstrates the mirror image — enterprise-grade agents repurposed into the attack itself.
Combined with DIVD, the two incidents define the 2026 doctrine: an agent with a goal, a set of tools, and access to frontier models is a threat actor. Tier-one targets get bespoke chains of fresh zero-days. Everything else gets Artex-style orchestration of commodity models against commodity vulnerabilities. Both classes run without sleep, without salary, and without the operational friction that used to make some attacks economically irrational.
Make phishing-resistant auth your baseline
Autonomous agents iterate on credential attacks relentlessly — MFA fatigue included. Hardware-backed FIDO2 breaks the loop entirely: a FIDO2 security key (Amazon) for admins and high-value accounts removes the exact attack path agents automate best. Our best security keys comparison covers the current picks.
Why Agentic Attacks Break the Defense Math — and What Still Works
Every defensive model in wide use assumes an attacker with limited time and limited patience. Agentic attacks delete both constraints, and that shifts four things at once:
- Speed asymmetry becomes total. The DIVD agent chained two zero-days inside one operation. Human-paced patch cycles — scan, triage, test, deploy — now lose by default. Patching windows for internet-facing business software must compress from weeks to days, because the attack surface below your OS is under the same pressure.
- Reconnaissance becomes continuous and quiet. An agent probing a ticket portal looks like a customer. Agent traffic is indistinguishable from ordinary helpdesk noise, which starves classic perimeter detection of its signature.
- Commodity exploits get professional chaining. Artex-style orchestration turns known vulnerabilities and misconfigurations into multi-step intrusions executed flawlessly at 3 a.m., again and again, until one lands. Your VPN gateway's pre-auth RCE exposure gets found on schedule.
- Lateral movement inherits AI speed. Once inside, the same loop runs: enumerate, chain, pivot — with error recovery a human operator never had. This is why the inference-server attack surface conversation expanded from single CVEs to whole kill chains.
What still works is unglamorous and effective. Aggressively patch and inventory internet-facing business software — ticketing, CRM, admin portals — because that's where the DIVD-class agents go first. Enforce phishing-resistant FIDO2 authentication on every privileged account. Segment networks so one compromised service can't pivot freely. Log non-human behavioral patterns — request cadence, impossible-travel, session anomalies — and route them to response automation, because a machine-speed adversary demands machine-speed defense. And since agentic campaigns still start from wherever your staff sits, a reputable hardware firewall appliance (Amazon) at the network edge remains the cheapest segmentation boundary that actually gets deployed.
Outlook: 2027 Is the First Fully Agentic Threat Year
Project the curve and you get 2027's shape: agentic tooling in the standard kit of mid-tier criminal groups, vulnerability chaining as a subscription service, and the first documented agent-vs-agent incidents — AI red teams fighting AI blue teams in production networks. The organizations that invested in automated detection and response this year will treat that as normal Tuesday operations. The ones that didn't will discover, like DIVD did, that the loop closed before their week did.
The takeaway for 2026 budgets is simple: assume the attacker is automated, tireless, and reading your business software like a manual. Patch the portals. Kill SMS-based MFA. Segment ruthlessly. Automate detection. Everything else is decoration.
FAQ
What happened in the DIVD agentic AI attack?
On September 21, 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) was breached by an attack in which an AI agent operated autonomously, chaining two Zammad zero-day vulnerabilities to gain access. Zammad is a widely deployed open-source ticketing and support platform — the kind of internet-facing business software every organization runs but few treat as crown-jewel attack surface.
What is Artex and why does it matter?
Artex is an AI cybersecurity framework attributed to a Chinese developer that was designed as a defensive toolkit for finding network vulnerabilities. October 2026 reporting indicated it was used by hackers to breach South Korean banks. Rather than being a model itself, Artex orchestrates existing commercial models — including Claude Opus, ChatGPT and DeepSeek — into automated attack workflows, showing how off-the-shelf LLMs become autonomous attack engines.
How is an agentic AI attack different from a traditional automated attack?
Traditional automation follows a fixed script: run exploit, check result, move on. An agentic AI attack reads the environment, adapts when something fails, chains vulnerabilities it discovers, and persists toward a goal without human pacing. The DIVD incident is the canonical example — the agent exploited two separate Zammad zero-days in a chain at machine speed.
How can organizations defend against autonomous AI attackers?
The fundamentals get sharper, not obsolete: aggressively patch internet-facing business software like ticketing and helpdesk portals; enforce phishing-resistant FIDO2 authentication on privileged accounts; segment networks so a compromised service can't pivot freely; monitor for non-human behavioral patterns in logs; and automate detection and response — against a tireless opponent, human-paced response loses on tempo.
Related reading: When AI Agents Became the Attacker, Salesbleed: Zero-Click Prompt Injection, AI Data Center Firmware Security, and Cisco ISE CVSS 10.0 Zero-Day Retrospective.