Today's data breach forensics has a new question: was the attacker even human? On October 1, 2026, DIVD — the Dutch Institute for Vulnerability Disclosure — was breached through zero-day vulnerabilities in Zammad, per October 2026 reporting. The attack scripts told on their author: self-justifying natural-language comments narrating each step, and decision sequencing investigators described as superhuman. Keyword research lists "data breach today" at 90,500 monthly searches (Semrush organic keywords, haveibeenpwned.com overview) — breach news is a daily drumbeat, but this one matters because of what the evidence says about who — or what — is attacking now.
On October 1, 2026, attackers breached DIVD, the Dutch institute that coordinates vulnerability disclosure to software vendors, exploiting zero-day vulnerabilities in Zammad, an open-source helpdesk platform, per October 2026 reporting. The recovered attack scripts contained self-justifying natural-language comments and showed superhuman decision sequencing — characteristics investigators read as fingerprints of AI-driven attacks.
Fingerprint 1 — self-justifying comments. The attack scripts contained natural-language comments explaining what each section was doing and why — narrating intent step by step. Human attackers rarely document their reasoning this thoroughly; verbose explanatory comments are a known artifact of AI-generated code, which tends to narrate its own logic. It is the equivalent of a burglar leaving annotated blueprints at the scene.
Fingerprint 2 — superhuman sequencing. The decision sequence across attack steps showed a speed and coherence investigators described as superhuman: steps chained with minimal dwell time, tool choices adapting fluidly, no wasted motion. Manual operators pause, mistype, backtrack, and sleep. This sequence reportedly did not.
Both are reported characteristics; AI authorship is inferred from them, not proven by them. That distinction matters — see the scope note on the checker below.
DIVD exists to find vulnerabilities and get them fixed. It was breached through unpatched helpdesk software. The lesson is not schadenfreude — it is that internet-facing ticketing systems sit on the same neglected patch tier everywhere, and attackers (human or AI) know it. If the disclosure institute's Zammad instance was reachable and unpatched, assume yours is a target too. Patch your helpdesk stack like edge infrastructure, because that is what it is.
Honest scope — read this first: these are heuristic indicators, NOT proof of AI authorship. A skilled human team can mimic some of these traits. Only full forensic analysis can attribute an attack. This checker scores how many AI indicators a breach shows — nothing more.
1. Did the attack scripts contain natural-language comments explaining intent?
2. Was the attack sequence unusually fast or coherent across many steps?
3. Did the attacker chain tools in novel or unusual combinations?
4. Was there little dwell time between intrusion steps?
5. Were there signs of automated adaptation after defenses triggered?
6. Did the tooling look generated rather than hand-built (uniform style, no personal quirks)?
Reporting: October 2026 industry coverage of the DIVD breach (October 1, 2026); AI-attribution details are reported characteristics, not independently verified forensics.
ChatBreaker — Ingenious AI's AI chatbot red-teaming platform — probes your AI systems the way attackers probe theirs, so you find the weaknesses before an AI-driven attack does. Get early access on WhatsApp.
DIVD is the Dutch Institute for Vulnerability Disclosure — a non-profit institute that finds software vulnerabilities and coordinates their disclosure to vendors so they can be fixed. The irony of the October 2026 breach is sharp: the organization that tells companies to patch was itself breached through unpatched software.
Zammad is an open-source helpdesk and ticketing platform. Per October 2026 reporting, the DIVD breach came through zero-day vulnerabilities in Zammad — flaws unknown to the vendor at the time of the attack. Specific CVE identifiers were not part of the reporting reviewed for this page, so treat any quoted CVE numbers for this incident as unverified.
They are natural-language comments inside malicious scripts that narrate what the script is doing and why — explaining intent step by step. Human attackers rarely document their reasoning so thoroughly; verbose explanatory comments are a known artifact of AI-generated code, which tends to narrate its own logic. Investigators flagged these as one of the AI fingerprints in the DIVD case.
No. The self-justifying comments and superhuman decision sequencing are heuristic indicators of AI involvement, not proof of AI authorship. A skilled human team could mimic some of these traits, and only full forensic analysis can attribute an attack. This page's checker is explicitly labeled: indicators, not proof.
Three lessons: patch internet-facing ticketing and helpdesk systems as aggressively as any other edge software; assume attack sequences can now run at AI speed, so detection must too; and preserve attack artifacts — scripts, logs, timelines — because the fingerprints of AI-driven attacks live in exactly those details.