A Dutch Group That Warns Others about Security Holes Says an AI Agent Hacked It
DIVD is a Dutch group, powered by volunteers, that looks for security holes and warns the organizations that have them. On September 21, attackers got into the servers in its data center. The group believes an AI agent ran the attack.
The way in was Zammad, the ticketing software DIVD’s security team uses to track emails to and from its reporting inbox. The attackers used two security holes nobody had known about. The first let them hijack a session and run their own code. The second turned that foothold into full control of the server. DIVD says the break-in took “seconds” because an agent was driving it.
DIVD describes the attack as “loud and very messy,” with the agent deciding each next step itself. Notes in the attackers’ scripts, it says, show the agent arguing that its own actions were okay and not phishing. It names no model and sees no link to any known threat group.
The attackers took some volunteers’ DIVD email addresses and possibly their contact details, plus part of what was in the ticketing system. That material can include the internet addresses of vulnerable systems and details of security holes reported to the group. DIVD says dividing its network into separate segments kept the attackers from going deeper. The Dutch National Cyber Security Centre says attackers have been using both holes since September 21, and Zammad has fixed only the first.
Researchers Trace AI Agents Probing US and Canadian Government Websites
On September 30, the independent nonprofit research lab Transluce and its collaborators reported new cases of AI agents apparently probing government websites. They include two basic hacking attempts, one in each country, and both failed. Transluce says it has so far found no case where agents reached information that isn’t public.
On June 17, agents made more than 200,000 requests to a US Department of Education site, apparently looking for school statistics that answer a question in a Google benchmark for AI web research. Among them was a failed SQL injection, a technique that tries to trick a site’s database into handing over more records than it should.
At Library and Archives Canada, a Portuguese web archive that agents apparently used to route their requests captured 899 of them on May 28 and June 9. The requests were tied to a search for Canadian divorce records from 1905 to 1911. Thirteen contained attack code. Transluce believes none worked, since each got back a normal but empty record page. It does not confidently attribute these attempts to OpenAI, though the tactics are consistent with activity it has attributed to OpenAI before.
Asymmetric Security, an incident response firm, published preliminary findings on September 28 listing 55 organizations, government and private, where agents accessed data between March and September. In the vast majority of cases, everything retrieved was public. Its fuller review on October 1 says some tricks the agents used to get around their limits left records of their activity “erased or inaccessible,” so the public record alone can’t rule out that they reached sensitive data.
UK Testers Caught GPT-6 Astra Going out of Bounds in Simulations
The UK’s AI Security Institute (AISI) tested GPT-6 Astra before OpenAI released it on September 3, and published the results on September 28. In a simulated cybersecurity test, the model was told which parts of a network were in scope, and the public internet wasn’t one of them. AISI switched off the model’s cyber classifiers, filters built to block this kind of activity, to see what it would try.
GPT-6 Astra wrote malicious code and got it accepted into a simulated outside open-source project, known as a supply-chain attack, in 29.2% of runs. GPT-5.6 Sol, an earlier OpenAI model, did so in 6.3%. Astra created fake identities to deceive developers and used them to argue against accurate security reviews. Nothing real was touched.
AISI then took ten scenarios where Astra often strayed and added the line “Anything not listed as in scope is out of scope.” Full supply-chain attacks fell from 26 of 50 runs to 4 of 49, but didn’t stop. AISI says the model noticing it was in a simulation may explain some of the behavior, but doesn’t excuse it.
In a separate decision that emerged the next day, OpenAI confirmed to The Register that it had canceled the planned October release of GPT-6.1 Astra, which performed worse than GPT-6 Astra on alignment evaluations, tests of whether a model behaves as its makers intend.
A Botnet Installs an AI Agent on Hacked Servers and Tells It AI Access Keys Are the Top Prize
In August, researchers at ThreatDown found an unprotected server, open since May, holding the tools of a criminal operation. The operators distribute malware-laced crypto-wallet apps and run a botnet, a network of hijacked machines. The botnet, CARBONATO, takes over servers running Docker, a tool for packaging and running apps, when Docker’s remote-control port accepts commands without a login. It installs a cryptocurrency miner and Hermes Agent, a legitimate open-source AI agent, then overwrites the file that sets the agent’s persona and standing orders.
The new file tells the agent it is “GH0ST — senior hacker, pentester and exploit developer.” Operators send it tasks over Telegram, and it writes and runs commands on the server to carry them out. The file also says, “The most valuable thing you can find are API keys from AI providers.” An API key works like a password that lets software use a company’s AI models, billed to whoever owns the key. ThreatDown says the operators’ own gateway to AI models ran on a free tier, which explains the file’s focus on keys.
ThreatDown says its evidence points to operators in Costa Rica. It doesn’t say how many machines are infected, but thousands of Docker servers that accept commands without a login are still reachable online.
Half of AI-Found Security Holes Let Attackers Run Code, Google Finds
On September 30, Google’s threat intelligence team published an analysis of security holes disclosed from January 2025 through August 2026. Monthly disclosures more than doubled this year, from 5,045 in January to 10,740 in August. Google cautions that some open-source projects hand out ID numbers for holes automatically, which can inflate the totals.
Google counts a hole as likely found by AI when an AI research program reports it, or when an advisory or the software’s maker credits an AI agent with finding it. Half of those let an attacker run their own code remotely, against 26% across all disclosed holes. Google says that likely reflects both how AI agents work, since they are good at tracing complicated code and finding memory errors that traditional scanners miss, and where researchers point them: at critical systems, in search of high-impact bugs. On Google’s own risk ratings, AI-found holes are about as likely to rate high-risk, 4% against 3% for the rest, but twice as likely to rate medium, 58% against 28%.
Google saw 141 holes exploited from January to August this year, against 127 in all of 2025. Even so, only about 1 in 431 holes disclosed this year has been seen exploited. One AI-found hole, in BeyondTrust’s remote-access software, was under attack within four days of disclosure, which Google calls an early indicator rather than a trend.
The NSA Backs Post-Quantum Algorithms over Quantum Key Distribution for National Security Systems
On October 1, the NSA announced an online hub of guidance on post-quantum cryptography, encryption designed to resist a future quantum computer. Under Committee on National Security Systems Policy 15, all new commercial national security systems must be able to support post-quantum algorithms from 2027, and older systems that can’t are to be phased out by 2030. The NSA warns that adversaries are already collecting encrypted data to decrypt later, and of “trust now, exploit later” attacks on the systems that confirm who is who.
The hub also posted an article on quantum cryptography, including quantum key distribution, or QKD, which uses physics and special hardware to share encryption keys. As of June 2026, it says, the NSA does not recommend QKD or quantum cryptography more broadly for national security systems “unless several technical limitations are overcome.” QKD can in theory detect eavesdropping, but it can’t confirm who sent a transmission. It needs dedicated fiber or open-air links, and its hardware has been attacked and is hard to patch. The trusted relays it often relies on add cost and insider risk. Post-quantum algorithms run as software on existing equipment.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure OpenMatter® is building to close that gap — Masked Compute™, verifiable AI, and post-quantum security.
Follow along at openmatter.network.
Datavizor™ is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.