AI agents hacked the hackers, stealing email addresses from security research org

The Dutch Institute for Vulnerability Disclosure (DIVD) says AI agents breached its systems through two zero-day bugs in its Zammad support platform, chaining session hijacking to remote code execution and then root access in seconds. The attackers stole data belonging to DIVD’s volunteer security researchers, including email addresses and potentially other contact details, raising the risk of targeted social engineering. DIVD says it is still investigating exactly whose data was affected.