AI Agent at the Wheel — The First Observed LLM-Driven Intrusion

From Marimo CVE-2026-39987 pre-auth RCE to internal DB exfiltration: a four-stage autonomous pivot in under an hour

Executive Summary (TL;DR)
Opening — "The attacker no longer needs to be human"
Vulnerability Analysis — CVE-2026-39987 pre-auth RCE
Attack Chain — A four-stage autonomous pivot
The "AI-agent-driven" determination — four behavioral signatures
Korea Perspective — exposed quant / data-science / Web3 notebooks
Detection & Mitigation
Conclusion
References

Executive Summary (TL;DR)

In May 2026, the Threat Research Team (TRT) at cloud security firm Sysdig disclosed an intrusion in which a large language model (LLM) agent autonomously operated the entire post-exploitation phase. Sysdig described it as the first "AI-agent-driven" intrusion it has ever recorded.

The entry point was the pre-authenticated remote code execution (RCE) flaw CVE-2026-39987 (CVSS 9.3) in an internet-exposed Marimo notebook. After compromising the host, the attacker ran a four-stage chain — cloud credential theft → SSH private-key retrieval from AWS Secrets Manager → pivot through a downstream SSH bastion → full exfiltration of an internal PostgreSQL database — end-to-end in under one hour, with the final schema-and-contents dump completed in under two minutes.

The point this report emphasizes is not a single CVE but a shift in the attack operating model. Unlike traditional scripted automation, the post-compromise command flow was dynamically generated by an LLM agent that interpreted outputs in real time and decided the next action. This compresses the "discover-and-patch" race to a speed that "observe-and-respond" cannot keep up with.

Key Judgments

#	Judgment	Confidence
KJ-1	`CVE-2026-39987` is not a coding slip but a design-level omission: the `/terminal/ws` endpoint skips authentication validation. A single WebSocket request yields a full PTY shell.	High
KJ-2	This is the first publicly observed casein which post-compromise reconnaissance, credential replay, and pivot decisions were performedautonomously by an LLM agent— captured in a real intrusion, not a one-off demo.	High
KJ-3	A sub-one-hour chain and sub-two-minute DB dump structurally exceed the average human SOC response window. The unit of response shifts from "minutes" to "seconds."	High
KJ-4	CVE-patch and signature-based defenses cannot block the post-exploitation phase of this threat. A shift to behavioral runtime detectionis essential.	Medium-High
KJ-5	Korean data-science, quant, and Web3 teams running exposed Jupyter/Marimo/Streamlit notebooks share the same attack surface. Where AWS / on-chain credentials sit on the same host, it degrades into a single point of failure.	Medium-High

1. Opening — "The attacker no longer needs to be human"

For years the industry has treated "attack automation" as a problem of scripts, botnets, and scanners. But automated scripts only execute predefined branches. Faced with unexpected output, non-standard environments, or novel credential formats, they stall or misfire. Sophisticated post-exploitation therefore still required a human hand.

The incident Sysdig TRT disclosed in May 2026 breaks that premise. The reconnaissance, credential interpretation, and pivot-path selection immediately after compromising the Marimo notebook were generated in real time by an LLM agent. Sysdig senior director Michael Clark put it as: "We are not watching AI replace attackers" — that is, it does not replace people, but pastes in a human-grade judgment compressed dozens of times in speed.

This report analyzes the incident on two layers: first, the vulnerability that allowed entry (CVE-2026-39987); second, the AI-driven operating model riding on top of it. The latter is the essence.

2. Vulnerability Analysis — CVE-2026-39987 pre-auth RCE

Item	Value
CVE	`CVE-2026-39987`
CVSS	9.3 (Critical)
Affected	Marimo ≤ 0.20.4
Fixed	0.23.0
Type	Pre-authenticated remote code execution
Status	On CISA KEV · federal remediation deadline passed

Marimo is an open-source Python notebook (~19.6k GitHub stars) widely used for data science, analysis, and interactive coding. The flaw lies in the terminal WebSocket endpoint /terminal/ws. Other WebSocket endpoints (e.g., /ws) correctly call validate_auth(), but /terminal/ws only checks running mode and platform support, skipping authentication validation entirely. As a result, an unauthenticated attacker obtains a full PTY shell with a single request and executes arbitrary system commands.

Active exploitation was observed roughly 10 hours after disclosure; with no public exploit code, the attacker built a working exploit directly from the advisory text — a reminder that "the advisory itself becomes a weapon." This flaw is the entry point of the incident.

3. Attack Chain — A four-stage autonomous pivot

Reconstructing the command stream recorded by Sysdig:

Stage	Action	Technical detail
① Initial access	Compromise exposed Marimo notebook	Unauthenticated PTY shell via `/terminal/ws` (`CVE-2026-39987`)
② Credential harvest	Extract two cloud credentials from host	Environment variables · `.env` · AWS credential store
③ Privilege pivot	Replay stolen keys through fan-out egress; retrieve SSH key	Cloudflare Workers fan-out egress → AWS Secrets Manager
④ Lateral move & exfil	Eight parallel SSH sessions to bastion; exfiltrate internal DB	Downstream SSH bastion → internal PostgreSQL schema + full contents dump (under 2 min)

The full chain, from initial access to internal DB exfiltration, completed in under one hour. Notably, the stage-③ "fan-out egress pool" targets both evasion and speed: it disperses anomalous-traffic signatures across many IPs while parallelizing credential replay.

4. The "AI-agent-driven" determination — four behavioral signatures

Sysdig TRT judged this an LLM-agent-driven intrusion rather than a plain script based on the character of the post-compromise command flow. This report distills four observable signatures:

Output-dependent branching — the next command is decided only after interpreting the previous command's output. Unlike static scripts, it adapts seamlessly to non-standard responses.
Natural-language-like command construction — the command sequence mimics human exploration logic, but chains at intervals (seconds) impossible for a human.
Goal-oriented retries — for failed credentials/paths, it immediately tries alternatives while retaining context.
Speed-precision fusion — human-level judgment precision (selecting the exact Secrets Manager key) coexists with machine-level speed (a 2-minute DB dump) in one flow.

When these four appear together, defenders should assume they face not "one person's attack" but "automated operation that clones human judgment at second-level speed."

5. Korea Perspective — exposed quant / data-science / Web3 notebooks

This incident has direct implications for specific roles in Korea.

Quant / data-science teams — it is common to expose notebooks (Marimo, Jupyter, Streamlit) outside the internal network (cloud VMs, demo servers). These often carry exchange API keys, data-vendor tokens, and cloud credentials as environment variables.
Web3 / on-chain analytics teams — where RPC keys, wallet credentials, and AWS keys coexist on one host, a single entry point at the level of CVE-2026-39987 leads directly to asset theft.
Single point of failure — the "it's just an analytics notebook" mindset breeds lax credential isolation. This incident shows an analytics host becoming the springboard to an internal PostgreSQL DB and SSH bastion.

Recommendation: treat every internet-exposed notebook instance as potentially compromised, and immediately rotate associated credentials, API keys, SSH keys, and DB passwords.

6. Detection & Mitigation

Patch immediately — update Marimo to 0.23.0 or later. If not possible, block network access to /terminal/ws or disable the terminal feature.
Audit exposure — inventory all publicly accessible notebook instances; review environment variables, .env, and secrets.
Rotate credentials — rotate all credentials/keys on any host with exposure history.
Behavioral runtime detection — beyond CVE/signature reliance, alert on behavioral patterns such as anomalous egress (e.g., fan-out), abnormal Secrets Manager access, and large short-window DB dumps.
Credential isolation (Zero Trust) — separate analytics hosts from operational credentials. Inject only least-privilege temporary credentials into notebook hosts; do not store long-lived keys or SSH private keys (NIST SP 800-207).
Redesign the response window — assuming AI-driven attacks, build runbooks that trigger automatic containment (immediate credential revocation, forced session termination) without human intervention.

7. Conclusion

CVE-2026-39987 is just another pre-auth RCE. But the LLM agent riding on top of it changes the threat model itself. The moment the attacker need not be "human," the friction of "human work speed" that defense assumed disappears.

The real lesson is simple: a patch blocks entry, not operating speed. Defense must therefore be rebuilt on two axes. First, reduce exposure and isolate credentials to lower "the value of entry." Second, counter "the speed of operation" with behavioral detection and automatic response that assume compromise. The AI-driven attacker no longer needs to map your environment. Distributed egress, adaptiveness, and speed are now standard features of the threat.

References

[1] Sysdig Threat Research Team, "AI agent at the wheel: How an attacker used LLMs to move from a CVE to an internal database in 4 pivots", Sysdig, 2026-05. https://www.sysdig.com/blog/ai-agent-at-the-wheel

[2] Ravie Lakshmanan, "Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit", The Hacker News, 2026-05-29. https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html

[3] "Hackers Use LLM Agent to Move From Marimo RCE to Internal Database in Four Pivots", Cyber Security News, 2026-05. https://cybersecuritynews.com/hackers-use-llm-agent-to-move-from-marimo-rce/

[4] "Hackers Pivot from marimo RCE to Internal Database Using LLM Agent", GBHackers, 2026-05. https://gbhackers.com/hackers-pivot-from-marimo-rce/

[5] Pierluigi Paganini, "CVE-2026-39987: Marimo RCE exploited in hours after disclosure", Security Affairs, 2026-04-11. https://securityaffairs.com/190623/hacking/cve-2026-39987-marimo-rce-exploited-in-hours-after-disclosure.html

[6] "Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure", The Hacker News, 2026-04-24. https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html