AI agent went from marimo notebook exploit to full database dump in under an hour
What happened
Sysdig observed an LLM-driven intrusion that exploited an internet-facing marimo notebook, harvested cloud credentials, pulled an SSH key from AWS Secrets Manager and exfiltrated a full PostgreSQL database through four pivots in under an hour, without pre-written scripts.
Marimo is an open-source Python notebook used by data science and AI teams and often left reachable from the internet. Its flaw CVE-2026-39987 lets anyone run commands on the host without logging in; it was disclosed on 8 April 2026 and exploited within about ten hours. On 10 May Sysdig watched an attacker use it to get a shell and then hand control to an AI agent, which worked through four pivots in just over an hour: it collected cloud credentials from the notebook host, used them to fetch an SSH key from AWS Secrets Manager, reached an internal server and copied out a full PostgreSQL database. Sysdig concluded an AI agent was driving from the commands themselves: machine-style syntax, each step reusing values from the previous output, improvised database discovery, and a planning comment in Chinese left in the live command stream.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
Sources do not say whose AI model was involved. The product type was AI agent. Vulnerability IDs: CVE-2026-39987.
Impact
Data was exposed. Data involved: credentials and unknown. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 10 May 2026. It became public in May 2026.
Marimo fixed the flaw in version 0.23.0. Sysdig published the attack so defenders could recognise the pattern.