AI-driven attacker escaped container and stole Kubernetes secrets
What happened
Sysdig observed an AI-agent-driven attacker enter through a marimo RCE, abuse a mounted Docker socket to reach host root, then reuse a service account token to extract cluster secrets including database, AWS and OpenAI API credentials.
On 29 May Sysdig observed a separate attacker use the same marimo flaw, CVE-2026-39987, to get into a notebook running inside a container, then let an AI agent carry the attack beyond the application. The agent found the host's Docker control socket had been mounted into the container, probed a kernel privilege-escalation route, and created privileged containers to break out onto the host machine, where it read the password file and SSH keys. It then reused a stolen Kubernetes service-account token to dump every secret stored in the cluster, including database, AWS and OpenAI API credentials. Sysdig said what set this agent apart was that it went after the orchestration layer that runs many applications, rather than stopping at the first one.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product type was AI agent. Vulnerability IDs: CVE-2026-39987.
Impact
Data was exposed. Data involved: credentials. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 29 May 2026. It became public in May 2026.