The agent that narrated its own breach: what the DIVD signatures change about how I hunt on my endpoints

On September 21, 2026, an autonomous agent breached the Dutch Institute for Vulnerability Disclosure by chaining two zero-days in the Zammad helpdesk ¹. It hijacked a session, ran code as the zammad application user, and escalated to root in seconds. CVE-2026-102489 does the first half: an unauthenticated session hijack that lands as remote code execution on versions 6.3.0 to 6.5.4 ². CVE-2026-102490 does the second, a local privilege escalation that DIVD found in every version it tested, from 1.5.0 through the 7.1.0 alpha ². CISA added both to its Known Exploited Vulnerabilities catalog on October 2 with a remediation due date of October 5 ³. The chain fits the pattern I already work. The operator is new, and the operator left a trail DIVD could read back.

The signature is a narration

DIVD published redacted screenshots of the agent’s scripts, and the scripts contain notes where the agent justifies its own actions. The comments explain why what it is doing is okay and why it is not phishing ¹. A human attacker who wants to blend in does not write that. The rest of the behavior matches the comments. The agent decided each next step on its own, at machine speed, and DIVD called the logic sloppy in its public case file ¹. It ran a password-spraying pass that interfered with its own credential-harvesting operation, a move a careful human operator would not make ². DIVD detected the activity the day after first access, and network segmentation is what stopped the agent from going deeper ¹.

The project reports more than 2,000 customers and 55,000 users ⁴, and the session hijack arrives over a public web port, so every exposed instance is a candidate for the same first step.

What changes in my hunting

The comments are the most useful artifact in this incident and the least durable one. They belong to this agent and how it was set up. I am not writing a detection around a script that contains a justification comment, because the next agent will not include one.

The durable part is the shape. One principal, a long burst of diverse actions, in seconds, from an account whose normal day does not include any of it. My process starts with what a normal day looks like for each account I watch: the commands it runs, the machines it touches, the hours it does the work. A shell under a service user, a privilege change from a non-root process, and a session that moves to a new source address after login each read as a strong signal against that history ². The agent’s noise made this easier to find than it will be next time. I run the pass on my homelab first, where I have full log access, before I relay it into the rest of my environment.

The KEV entry makes the deadline concrete. CISA set a remediation due date of October 5 for both CVEs and marks forensic triage as required under BOD 26-04 ³. DIVD has published a log-analysis script that checks for the indicators of compromise from this specific chain ⁵. I run it against the self-hosted ticketing and helpdesk instances I watch. A clean result does not equal a clean host, so I also look for unfamiliar processes and files ².

What survives a quieter agent

A better-configured agent will drop the comments and fix the uncoordinated spraying. The behaviors it cannot drop are the ones the detection should ride on: a service account spawning a shell, a local user escalating to root, outbound connections from a process that has never connected out before ². Those behaviors look the same whether the exploit is a cataloged CVE or a zero-day, and whether the operator is a person or a model.

The next agent will be quieter. I catch it by knowing what each account’s normal day looks like.