The Hackers Got Hacked by a Sloppy AI Agent.Speed Matters.

Two zero-days, and seconds to root

On September 21, something knocked on DIVD’s front door via Zammad, the open-source ticketing platform they used to manage their own vulnerability disclosures. By September 30, DIVD knew exactly how: two zero-day flaws, chained. CVE-2026-102489 — unauthenticated remote code execution plus session leakage. CVE-2026-102490 — local privilege escalation straight to root. CVSS 9.4 each.⁴

In seconds — DIVD’s own words:

The attacker was an AI agent, and it was bad at its job

Here’s the detail that makes this more than a funny story: the attacker was an AI agent, and it was bad at its job.

DIVD called the attack “loud and very, very messy.” The agent decided its next step after every single action — “at the speed of light and sloppy logic or pattern.” It did, and I quote, “some pretty dumb things.” At one point it interfered with its own adversary-in-the-middle attack by password-spraying at the same time.³ Picture a burglar tripping over his own shoelaces mid-break-in.

The first advantage may not be intelligence

We spend a lot of time asking whether AI is smarter than us. That may be the wrong question. This agent didn’t need to be smarter. It was sloppy, interfered with its own attack, and left embarrassing comments in its scripts explaining why what it was doing was “really not phishing.”

And it still won. It didn’t need to reason better than a human attacker. It could observe, decide, act, observe again — and make the next decision before a human had time to respond to the last one. In a system where its actions execute without asking, speed compensates for mediocre reasoning.

That changes the threat model. An agent does not have to beat human judgment if its action loop moves faster than human oversight can respond.

The agent couldn’t stop explaining itself

And then there’s the diary. The agent couldn’t stop explaining itself. It left notes in its attack scripts — comments justifying what it was doing and why it was fine. DIVD’s team, reading them during the investigation, wrote:³

All that overexplaining made the attack easier to reverse-engineer. Unusually detailed explanations, handed over by the attacker itself.

A log is not a leash

Even that did not stop execution. The reconstruction happened after root. What actually contained the blast radius was network segmentation: the old, dumb, architectural kind of defense.¹ No decision-point stopped the chain itself.

That is the limit this incident exposes: unusually good visibility can make an attack easier to reconstruct without making it easier to stop in time.

We keep building better microscopes — logs, transcripts, incident registries, postmortems, disclosures — and confusing them with governance. DIVD’s incident shows the limit of that confusion in the starkest possible way: unusually good visibility, and nothing that stopped the chain in time. None of them sits on the execution path between decision and action.

Who could have stopped it?

Call it “rogue” if you like, but that word describes our surprise, not the system’s permissions. The important question isn’t whether the agent looked “rogue.” It had the capability to act, the access to matter, and the speed to keep going. What was missing was anyone with the authority to say not this action, not now.

When the action loop outruns the intervention loop, human oversight becomes retrospective. The checkpoint has to sit outside the actor’s own decision loop — and on the execution path. Otherwise you’ve just built a fancier mirror.

That is the problem we’re working on with Intent Checkpoint: putting an independent check between an agent’s decision and execution, while there is still something to stop.

Your logs may tell you how the agent got root.
The governance question is who could have stopped it before it did.