AI agents can now run sequences of research tasks with little human input. The question is who answers for the results. The European Commission has published the fourth version of its ERA Living Guidelines on the responsible use of generative AI in research, and its answer is clear: researchers remain accountable, no matter how much work they hand to an AI agent.

Published on 15 October 2026, this is the most comprehensive update since the guidelines first appeared in March 2024. It adds guidance on agentic AI and expands advice on AI use in peer review and proposal evaluation. The previous revision came in May 2026.

What Changes for Generative AI in Research

The biggest addition covers agentic AI, systems that can pursue complex goals and act with some degree of autonomy. The guidelines state that using AI agents may never be treated as a delegation of control or responsibility.

Researchers are asked to build checkpoints into agent-driven work so that critical decisions, such as methodological choices, are validated by humans. Any hypothesis generated, data processed or conclusion drawn by an AI agent requires human validation. The document also warns that researchers are not exempt from legal responsibility because an agent acted on their behalf.

The guidelines repeat that AI systems cannot be authors, co-authors or owners of research, since authorship implies agency and responsibility.

New Rules of Thumb on AI Disclosure

On AI disclosure, the guidelines draw a clearer line. Researchers should disclose AI tools used substantially, such as for literature reviews, identifying research gaps, developing hypotheses or interpreting data. Minor uses like spellchecking, grammar correction or formatting generally do not need disclosure. In case of doubt, disclosure is advised.

Researchers are also asked to consider that generative AI can produce different outputs from the same input, which may affect reproducibility. Authors decide whether prompts, logs and model versions should be kept or shared.

The document notes that a global reporting standard for AI disclosure is being developed at the World Conference on Research Integrity 2026 in Vancouver, which will inform future versions.

Peer Review and Hidden Prompts in Generative AI in Research

The guidelines say peer review remains a fundamentally human process. AI should not be used to assess novelty, originality, significance or whether a manuscript should be accepted or rejected. Confidentiality is described as non-negotiable, and unpublished material should not be uploaded to tools that cannot guarantee it won’t be used for training.

For funding bodies, the update flags a new risk: hidden prompts. These are instructions secretly embedded in documents, through invisible text, formatting tricks or metadata, designed to steer an AI tool toward a more favourable assessment. Funders are advised to set clear rules prohibiting such manipulation and add safeguards in the IT systems that process applications.

The guidelines also note that AI-polished proposals are increasing application volumes and overloading evaluators, and suggest the evaluation process may need to be redesigned to be more AI-resilient.

Security and Confidentiality Remain Central

Research organisations are encouraged to deploy locally hosted or self-governed AI tools so staff can work with scientific data while protecting confidentiality and research security. They are also told to ensure appropriate cybersecurity for these systems, especially those connected to the internet.

The document identifies systemic risks too, including dependence on proprietary AI systems and the concentration of AI capabilities and infrastructure outside the EU.

Non-Binding, but Built on Research Integrity

The guidelines are non-binding and do not replace existing laws or institutional rules. They rest on four principles: consider whether AI is the right tool, accountability stays with researchers and institutions, confidentiality is non-negotiable, and transparency builds trust. These draw on established research integrity frameworks, including the European Code of Conduct for Research Integrity.

The guidelines were developed with countries and stakeholders across the European Research Area. The next revision is planned for the third quarter of 2027, and an open feedback process remains available for contributions.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

DIVD was breached through two Zammad zero-days that let an AI agent reach root in seconds, steal data and pivot to other services before being stopped.

The Dutch Institute for Vulnerability Disclosure, a nonprofit organization of volunteer security researchers whose whole job is finding and responsibly disclosing vulnerabilities in other people’s software, just disclosed that it got breached through two zero-days in its own ticketing system.

The attackers got in through Zammad, an open-source helpdesk platform that DIVD used internally. Working with Merlon Security, DIVD identified two previously unknown vulnerabilities, tracked as CVE-2026-102489 and CVE-2026-102490.

Each vulnerability was serious on its own, but chaining them made the attack much more dangerous. The attackers could hijack sessions, run code remotely and move from a regular Zammad account to root access within seconds. DIVD said the speed was linked to the use of an AI agent during the attack.

“When hackers get hacked, we deal with it in hacker style. While trying to figure out how the attackers got into our own systems, 𝘄𝗲 𝗳𝗼𝘂𝗻𝗱 𝘁𝘄𝗼 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗭𝗮𝗺𝗺𝗮𝗱.” the organization wrote on LinkedIn. “Used together, they allowed the attackers to hijack sessions, run code remotely and escalate privileges from the Zammad user to root, in seconds, due to the agentic part of this hack. From there they were able to access other services and read and exfiltrate data. We urge everyone using any version of Zammad to update to version 7 or take it offline as soon as possible.”

The attacker went from the initial access to root privileges in just seconds. The AI agent was able to make decisions and carry out the next steps without waiting for a human operator.

After gaining root access through Zammad, the attacker reached other services, accessed data and stole some of it. Network segmentation and a quick response from DIVD’s IT and incident response teams prevented the attacker from moving further.

However, DIVD said that some damage had already occurred before the attack was stopped. The investigation is still ongoing, with the next public update expected on October 1.

Zammad has over 2,000 customers and 55,000 users. DIVD is actively notifying owners of vulnerable instances and has published a script to check logs for signs of abuse. The fix is version 7, which Zammad considers safe. If you can’t update immediately, the guidance is simple:

“We’re still in full investigation mode, and our next public statement will be on October 1st. For more information about the CVEs and a script to check your logs for abuse, check our case file. Link in comments.” the organization states. “If you run any version of Zammad, update to version 7 or take it offline as soon as possible.”

The advice from Zammad is clear: update to version 7 or take the system offline. The reason is simple: the attack can move from unauthenticated access to root privileges within seconds, with the AI agent automatically carrying out each step.

The incident also shows that AI-driven attacks are no longer just a theoretical risk. In this case, the agent was able to analyze the environment, chain the two vulnerabilities, gain higher privileges and move to other services without a human directing every action.

DIVD detected the attack partly because it was relatively noisy. The agent left visible traces of its activity, which helped investigators understand what happened. A more careful attacker using the same approach could be harder to detect.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zammad)