Agentic AI Hacked the Hackers at a Dutch Bug-Hunting Nonprofit

The Dutch Institute for Vulnerability Disclosure says an agentic AI chained two zero-days in its Zammad ticketing system, hijacked sessions, escalated to root, and stole volunteer researchers' email addresses in seconds. The hunters got hunted by a script that left notes to itself in its code justifying its actions, because apparently even malware has a conscience now.