According to CoinMeta, autonomous AI proxies successfully attacked a Dutch vulnerability disclosure organization ( DIVD ) on September 21, 2026, by exploiting two zero-day vulnerabilities ( Zammad ) in a chained manner. This organization is responsible for scanning internet security vulnerabilities and notifying system owners. DIVD disclosed this intrusion incident on September 24, describing it as an attack driven by autonomous AI. On September 30, DIVD identified the attack vectors: two unknown vulnerabilities ( CVE-2026-102489 and CVE-2026-102490 ), both with a CVSS score of 9.4. The first vulnerability was a session hijacking that led to remote code execution for Zammad users, affecting multiple versions; the second vulnerability allowed for local privilege escalation, enabling users to gain root privileges. Combined, these vulnerabilities enabled attackers to hijack sessions and execute code within seconds. DIVD is currently scanning other vulnerable Zammad instances and recommends that users upgrade to version 7.