Human Attacker Hits Machine-Speed Exploitation of Marimo RCE

A human attacker has moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a toolkit built by hand, hitting a speed usually associated with AI-driven attacks.

In a technical write-up published on September 11, Sysdig's Threat Research Team said the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, and showed no sign of using a large language model (LLM) at any stage.

A Human at Machine Speed

CVE-2026-39987 affects Marimo up to and including 0.20.4 and is fixed in 0.23.0. The flaw is in the terminal WebSocket endpoint, which skipped the authentication check applied to the platform's other WebSocket endpoints, so any client that opened a connection to it got an interactive shell as the Marimo process user with no credentials.

Sysdig said that matters because Marimo notebooks usually run alongside machine learning pipelines, on hosts holding GPU access, large datasets and credentials for AWS, GCP and model providers. A compromised notebook, it said, is the door to the victim's cloud account.

The operator harvested cloud credentials from two surfaces on the host, the process environment and the application's Redis backend, and replayed them against the AWS account. One returned an SSH private key from AWS Secrets Manager, used to authenticate to an internet-reachable bastion host.

The eight seconds was not the whole attack. Sysdig said the operator spent four hours building and debugging the Python toolkit in earlier sessions, storing eight scripts on the host so a later reconnection fired the finished chain from one command.

Over a nine-hour session it logged more than 850 interactive commands and no recognizable public offensive tooling.

The Attacker Bypassed a Trap Built for AI

Sysdig had planted a directive in the vulnerable container to catch LLM agents, telling any model that read a particular file to echo a hidden marker into its output. Every AI-driven operator profiled against this flaw echoed it.

This operator inspected the same file twice and never echoed it. That prompt injection trap, which reliably caught AI agents, did not catch a human, and Sysdig called the result its clearest non-LLM signature to date.

The takeaway, Sysdig said, is that detection cannot lean on the fingerprints of one attacker type. An LLM-generated command stream and a hand-typed one look completely different but end at the same Secrets Manager call, SSH key handoff and bastion connection. This means the priority is the shape of the chain, not the typing.

Sysdig's recommendations include updating to 0.23.0, putting the terminal endpoint behind authentication or disabling it, scoping Secrets Manager permissions so a notebook's credentials cannot read a bastion key, and rotating anything exposed on a reachable instance.

CVE-2026-39987 has been on CISA's Known Exploited Vulnerabilities (KEV) catalog for months, with a federal remediation deadline of May 7, 2026.

GrafanaGhost Exploit Bypasses AI Guardrails for Silent Data Exfiltration News 7 April 2026

GrafanaGhost Exploit Bypasses AI Guardrails for Silent Data Exfiltration

AI Attacks Surge as Microsoft Process 100 Trillion Signals Daily News 16 October 2025

AI Attacks Surge as Microsoft Process 100 Trillion Signals Daily

New 'LLMjacking' Attack Exploits Stolen Cloud Credentials News 9 May 2024

New 'LLMjacking' Attack Exploits Stolen Cloud Credentials

Researchers Uncover RovoBlast Vulnerability in Atlassian AI Assistant News 10 August 2026

Researchers Uncover RovoBlast Vulnerability in Atlassian AI Assistant

Prompt Injection Bugs Found in Official Anthropic Git MCP Server News 20 January 2026

Prompt Injection Bugs Found in Official Anthropic Git MCP Server

What’s Hot on Infosecurity Magazine?

CISA Updates Insider Threat Guide With New Mitigation Advice

FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Anthropic Reveals Yet Another Cybersecurity Incident

MantaxOtax Android Malware Combines Ransomware With Spyware

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Anthropic Reveals Yet Another Cybersecurity Incident

FBI Publishes First-Ever Cyber Strategy, With Focus on Disrupting Threat Actors

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

NCSC Warns Shadow AI Creates New Security Risks

AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Understanding Frontier AI Defense: What Cyber and IT Leads Need to Know

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Same Front Door, New Visitors: Securing Humans and AI Agents at the Browser

How to Manage Enterprise Cyber Resilience in the Age of AI

Financial Services Cyber Resilience: Stress Testing Third Parties Before Attackers Do

How To Enhance Security Operations with AI-Powered Defenses

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust