AI agents hacked the hackers, stealing email addresses from security research org

Dutch vulnerability-disclosure nonprofit DIVD was breached through two Zammad zero-days, allowing attackers to hijack sessions, execute code remotely and escalate privileges to root within seconds. The attackers stole volunteer researcher email addresses and potentially additional contact data, creating elevated social-engineering risk. The vulnerabilities, CVE-2026-102489 and CVE-2026-102490, each carry a chained-attack CVSS 4.0 score of 9.4; DIVD advises Zammad users to upgrade to version 7 or take systems offline. DIVD said the unusually automated, noisy attack pattern indicated a potentially agentic-AI-enabled operation.

Analysis

The investable implication is not a direct read-through to a listed victim, but an acceleration in the economics of vulnerability remediation: internet-facing support, identity, and workflow applications now carry a materially shorter exploit-to-impact window. Enterprises will prioritize continuous external attack-surface monitoring, privileged-access controls, endpoint detection, and incident-response retainers over discretionary point tools. This favors platform vendors with embedded telemetry and distribution—PANW, CRWD, MSFT and OKTA—while increasing pressure on under-resourced open-source and self-hosted software deployments.

Near-term, the “agentic” attribution should be treated cautiously: attack-script artifacts are not forensic proof of autonomous AI operation. Markets may nevertheless re-rate cyber demand expectations because automated reconnaissance and exploit chaining lower attacker labor costs, increasing breach frequency even if each individual technique is conventional. The 1-3 month catalyst is disclosure of additional exploited installations or government/CISA-style guidance; that would shift this from anecdotal threat narrative to a measurable budget trigger.

The second-order risk is that AI-enabled attacks raise liability and insurance costs for organizations running unsupported or lightly maintained operational software. This supports cyber insurers and managed-security providers, but could also create valuation risk for security vendors whose products are marketed as preventive controls if customers conclude that response and resilience matter more than prevention. Over 6-18 months, expect consolidation toward integrated security platforms and away from fragmented tools with weak identity, cloud, and endpoint integration.

Contrarian view: broad cyber equities may already price a recurring breach-driven demand uplift. The stronger trade is selective exposure to vendors with measurable net-new platform consolidation and incident-response monetization, rather than buying the entire HACK/CIBR complex on a single incident.

Key Decisions for Investors

• Maintain a 1-3 month long bias in PANW versus HACK: PANW is better positioned for platform consolidation and security-operations spend; reassess if next-quarter NGS ARR/billings commentary shows no incremental demand or if the relative spread underperforms by 10%.
• Watch CRWD for incident-response and Falcon module attach-rate commentary at the next earnings cycle; initiate only on evidence that large-enterprise deal size or module adoption is accelerating. Risk/reward is unattractive if growth remains dependent on pricing rather than seat/module expansion.
• Use MSFT as the lower-beta beneficiary through identity, endpoint, and cloud-security bundle penetration; pair long MSFT/short a high-multiple single-product security basket only if enterprise CIO surveys confirm budget reallocation toward consolidated platforms over the next 1-2 quarters.
• Do not trade the AI-attack narrative directly until independent telemetry establishes broader exploitation. Set an alert for confirmed mass exploitation, regulator guidance, or cyber-insurance premium increases; those would validate a more durable 6-18 month security-spend upgrade.