AI-Powered Agent Crashes Dutch Vulnerability Hub in Chaotic Breach

The Dutch Institute for Vulnerability Disclosure (DIVD) confirmed that it fell victim to a cyberattack driven by an automated artificial‑intelligence agent, describing the incident as "loud and very, very messy."

DIVD, a nonprofit that coordinates the reporting and handling of software vulnerabilities across the Netherlands, serves as a trusted intermediary between security researchers and affected vendors. Its open‑source platform and public disclosure policies make it a high‑profile target for actors seeking to demonstrate the potency of new attack tools.

According to the initial report, the malicious AI system was programmed to probe the organization’s public‑facing services, generate exploit code on the fly and then launch a coordinated intrusion. While technical details remain limited, analysts suggest the tool leveraged large‑language‑model capabilities to automate vulnerability discovery, payload crafting and command‑and‑control communication without direct human oversight.

The breach disrupted DIVD’s operations, forced a temporary shutdown of its vulnerability database, and raised concerns about the exposure of sensitive researcher contact information. In a statement, the institute warned that the attack "exploited automated processes in ways we have not previously encountered," and pledged to work with law‑enforcement and cybersecurity partners to contain the fallout.

Security experts say the incident underscores a growing trend: AI‑enhanced tools are lowering the barrier for sophisticated attacks, even against organizations that lack the resources of large corporations. The episode may prompt nonprofits and other small‑to‑medium entities to reassess their defensive posture, invest in AI‑aware monitoring solutions, and collaborate on shared threat intelligence. As the investigation proceeds, the community will be watching how quickly DIVD can restore its services and what safeguards emerge to counter the next generation of AI‑driven threats.