Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
Sysdig says an attacker used an LLM agent after exploiting Marimo CVE-2026-39987, speeding credential theft and database exfiltration.
Intelligence analysis by GPT-5.4 Mini
Sysdig describes a May 10 intrusion where an attacker exploited a Marimo notebook, stole cloud and SSH credentials, and used an LLM agent to adaptively drive post-exploitation steps. The company says the activity ended with rapid access to an internal PostgreSQL database.
A hacker got into a computer program that was left open to the internet. That first break-in let the attacker grab secrets and unlock more doors inside the company’s systems.
Sysdig says the attacker did not act like a simple robot script. It looked more like a smart helper was choosing the next step based on what it found, like a detective changing plans after opening a new door.
That matters because the attack could keep adjusting instead of getting stuck. The fix is to patch the software, check for public copies, and replace stolen keys so the old keys stop working.
Analysis
What happened
Sysdig says an unknown attacker compromised an internet-reachable Marimo notebook through CVE-2026-39987, a critical pre-authenticated remote code execution flaw affecting Marimo versions up to and including 0.20.4. From there, the attacker pulled two cloud credentials from the host, replayed them through a distributed egress pool, and used the resulting AWS access to fetch an SSH private key from AWS Secrets Manager.
How the post-exploitation worked
According to Sysdig, the attacker then used that key to open eight short SSH sessions against a downstream bastion host. That phase was enough to extract both the schema and the full contents of an internal PostgreSQL database in under two minutes. The full chain, from initial compromise to data theft, lasted a little over an hour.
Sysdig says it found four signs that an LLM agent was involved. One was the attacker’s ability to improvise a database dump without prior knowledge of the schema. Another was a Chinese-language planning note that appeared in the command stream: “See what else we can do.” The third was the machine-oriented command style, with commands separated by ---, bounded output, disabled less, and stderr discarded to reduce noise. The fourth was evidence that values from earlier tool output were fed into later actions, such as reading ~/.pgpass and then moving to the next step.
Why the firm thinks this matters
Sysdig’s core point is that an agent-in-the-loop changes the attacker’s behavior. A scripted playbook fails when the target looks different than expected; an agent can react to missing files, odd schemas, or authentication issues and keep adapting. The recommended response is straightforward: update Marimo, look for exposed instances, and rotate credentials, API keys, and SSH keys.
Key points
- Sysdig says Marimo CVE-2026-39987 was used for initial access to an internet-facing notebook.
- The attacker allegedly stole cloud credentials, then used AWS Secrets Manager to retrieve an SSH private key.
- Eight short SSH sessions were used to pull data from an internal PostgreSQL database.
- Sysdig says several clues suggest an LLM agent helped drive the post-exploitation steps.
- The recommended defense is to patch Marimo and rotate exposed credentials and keys.
