Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
Summary: An unknown threat actor exploited CVE-2026-39987, a critical pre-authenticated remote code execution flaw in Marimo versions up to and including 0.20.4, to compromise an internet-reachable notebook on May 10, 2026, then used an LLM agent to drive post-exploitation. The chain pulled two cloud credentials from the host, replayed them through a fanned-out egress pool to fetch an SSH private key from AWS Secrets Manager, and ran eight parallel SSH sessions against a bastion to exfiltrate an internal PostgreSQL database's schema and full contents in under two minutes, with the end-to-end attack lasting a little over an hour.
What you should know: Sysdig's four indicators of an agent in the loop - an improvised dump of an opaque schema, a leaked Chinese planning comment reading "See what else we can do," machine-formatted commands, and values fed from prior tool output - mean the cost of adding a new target is inference budget rather than playbook engineering. A scripted attacker aborts or falls back when it hits a missing file or failed authentication; an agent reads the surprise and keeps going, so your environment's unfamiliarity is no longer a barrier.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Mentions
- CVE-2026-39987
- Related
- CVE-2026-39987: Marimo Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 23, 2026