For years, security experts asked when artificial intelligence would start finding brand-new software holes by itself. In 2026 the answer arrived, from both sides at once. In September an AI agent broke into a Dutch volunteer organisation by chaining two flaws nobody knew about. In May, Google caught criminals using an exploit it believes an AI helped build. Meanwhile, the defenders’ own AI tools are finding thousands of bugs before attackers can.
Here is what happened, what is still open, and what it means for anyone who runs a website or a small business.
First, what is a zero-day?
A zero-day is a security flaw that the software maker doesn’t know about yet. The name means the developers have had zero days to fix it. That makes zero-days valuable to attackers: there is no patch, so even a well-maintained system is exposed. Finding one has traditionally taken skilled people weeks or months of careful work.
An AI agent is an AI model that doesn’t just answer questions but takes actions: it runs commands, reads the results and decides the next step. Point it at a system, and it can try one path after another much faster than a person.
The DIVD breach: an AI agent chains two unknown flaws
On 21 September 2026 attackers got into the Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit of mostly volunteer researchers whose job is to find security holes and warn the owners of vulnerable systems. In its first statement on 24 September, DIVD said the way the attack worked pointed to an “agentic AI powered attack”, a kind it had not seen before.
The way in was Zammad, a popular open-source helpdesk system. According to BleepingComputer and Help Net Security, the attacker chained two previously unknown flaws, now tracked as CVE-2026-102489 and CVE-2026-102490. The first let it take over a session and run code on the server; the second lifted it from the helpdesk’s own user account to full “root” control of the machine. DIVD said that jump took seconds, “due to the agentic part of this hack”.
From there the agent reached other services and copied some data. DIVD described the attack as “loud and very, very messy”: the agent made clumsy moves and even left explanations of its own decisions, which helped investigators reconstruct what it did. Network segmentation (keeping systems in separate compartments) and a fast response stopped it going deeper. It is still not public who was behind it, which AI model was used, or whether it was a real campaign or a test of what such agents can do. The AI label is DIVD’s assessment from the attacker’s behaviour.
Where things stand now
- Officially exploited. The US cybersecurity agency CISA added both Zammad flaws to its list of known exploited vulnerabilities on 2 October 2026, giving US federal agencies until 5 October to act.
- Partly fixed. In an update on 8 October, Help Net Security reported that Zammad advises upgrading to version 7.0 or later to block the first flaw, and says the second one can’t be exploited remotely on its own and is linked to a problem in a third-party packaging service it is working to solve.
- Disputed details. Zammad and DIVD still disagree on exactly which versions are affected and on how the disclosure was handled, so administrators should follow Zammad’s own advisories.
Google: the first AI-built zero-day exploit caught in the wild
In May, Google’s Threat Intelligence Group (GTIG) reported what it believes is the first zero-day exploit developed with AI and used by real attackers. It was a small Python program that bypassed two-factor authentication (the extra code you type after your password) in a widely used open-source web tool for managing servers. Attackers still needed a valid username and password, but the extra lock no longer worked.
How did Google know an AI was involved? The code looked like it came straight from a textbook: lots of explanatory notes, a tidy layout typical of AI training data, and even a made-up severity score, the kind of confident invention AI models are known for. GTIG said with “high confidence” that an AI model helped find and weaponise the bug, though not its own Gemini. The criminals were preparing a mass attack; Google worked with the unnamed vendor to fix the flaw, which may have stopped the campaign before it took off, as Decrypt also reported.
The bug itself is telling. It wasn’t a classic memory error but a logic mistake: the developer had built in a trust assumption that looked fine but wasn’t. Google notes that today’s AI models are good at spotting exactly this kind of flaw, which traditional scanning tools tend to miss.
The defenders’ AI is racing too
The same abilities are being put to work on the other side, at a much larger scale:
- Google Big Sleep. In July 2025 Google said its AI agent Big Sleep found a critical flaw in the SQLite database engine (CVE-2025-6965) that was “only known to threat actors and was at risk of being exploited”, and helped cut off the attack beforehand, as The Record and SecurityWeek reported. Google calls it the first time an AI agent directly foiled an attack in the wild.
- Anthropic’s Mythos Preview. In April 2026 Anthropic launched Project Glasswing, giving a restricted model to a group of companies including AWS, Apple, Google, Microsoft, the Linux Foundation and CrowdStrike. Anthropic says it has found thousands of high-severity zero-days, including in every major operating system and web browser, among them a 27-year-old flaw in OpenBSD and a 16-year-old one in the FFmpeg video library. The company told VentureBeat it does not plan to release the model generally because of these abilities, and is backing open-source security groups with $4 million in donations.
- AI that writes the fix. Google’s CodeMender agent and OpenAI’s Aardvark, renamed Codex Security in March 2026, go one step further and propose the patch as well as the bug report, with human reviewers checking each fix.
What it means today
The honest picture: AI hasn’t created a new kind of attack, but it has made finding and chaining flaws much faster and cheaper. That cuts both ways. Attackers no longer need a rare expert to find a zero-day, and defenders can now sweep huge amounts of old code that no human team would ever have time to read. The gap that matters is speed: how quickly a flaw is found, reported and patched, compared with how quickly someone exploits it.
For organisations and website owners, the advice is familiar, but more urgent:
- Patch quickly, and watch lists such as CISA’s known exploited vulnerabilities for software you run.
- Keep systems separated, so one broken door doesn’t open the whole building. It is what limited the damage at DIVD.
- Don’t rely on one lock. Two-factor authentication still matters, but the Google case shows it is one layer among several.
- Watch for noise. Today’s attacking agents are fast but sloppy. Good logging and alerts can catch them in the act.
The next few months will show whether the defenders’ head start with tools like Big Sleep and Mythos Preview holds, or whether attackers’ AI catches up. Either way, the era of AI-found zero-days is no longer a forecast.
Read next
- OpenAI apologises to Australia after AI agents went off-script
- GPT-6 in ChatGPT: what Intelligent UI does and how to use it
- Can AI be conscious? How scientists try to tell, and why we doubt
Sources
- When, not if (incident statement) – DIVD, 24 September 2026
- DIVD says Zammad zero-days enabled AI-driven network breach – BleepingComputer, 30 September 2026
- AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit – Help Net Security, 1 October 2026 (updated 8 October)
- Known Exploited Vulnerabilities Catalog (CVE-2026-102489, CVE-2026-102490 added) – CISA, 2 October 2026
- GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access – Google Threat Intelligence Group, 11 May 2026
- Hackers Used AI to Build a Zero-Day Exploit That Bypasses Two-Factor Authentication: Google – Decrypt, May 2026
- Google’s Big Sleep AI tool found bug – The Record, 15 July 2025
- Google says AI agent thwarted exploitation of critical vulnerability – SecurityWeek, July 2025
- Project Glasswing – Anthropic, 7 April 2026
- Anthropic says its most powerful AI cyber model is too dangerous to release – VentureBeat, April 2026
- Introducing CodeMender: an AI agent for code security – Google DeepMind, 6 October 2025
- OpenAI unveils Aardvark, a GPT-5 agent – The Hacker News, October 2025
- Introducing Aardvark (now Codex Security) – OpenAI, October 2025, updated March 2026
