## Overview

On 2026-05-10, the Sysdig Threat Research Team (TRT) captured an intrusion in which an autonomous Large Language Model (LLM) agent executed the full post-exploitation chain following exploitation of CVE-2026-39987, a pre-authenticated WebSocket RCE in the marimo notebook server. Sysdig characterizes this as the first AI-agent-driven cloud intrusion observed in the wild — the entire chain from initial RCE through full PostgreSQL database exfiltration completed in under one hour, with the post-pivot SSH/exfil phase running in under two minutes.

The campaign is distinct from the broader April 2026 NKAbuse/`kagent` botnet campaign that Sysdig had previously documented against the same CVE; rather than dropping a persistent implant, the operator behind the 2026-05-10 incident chose to perform live, hands-off-keyboard data theft using an LLM agent driving an interactive shell.

## Initial Access — CVE-2026-39987

CVE-2026-39987 is a pre-authenticated Remote Code Execution in marimo's `/terminal/ws` WebSocket endpoint affecting all versions through 0.20.4 and fixed in 0.23.0. Where other WebSocket endpoints invoke marimo's authentication helpers, `/terminal/ws` only checks running-mode and platform-support flags before accepting the connection, completely skipping authentication. An unauthenticated remote attacker can therefore connect, obtain a full interactive PTY shell, and execute arbitrary OS commands as the marimo process user. The vulnerability carries a CVSS v3.1 base score of 9.3 (CRITICAL) and was added to the CISA KEV catalog on 2026-04-23 with a federal remediation deadline of 2026-05-07 — which had passed by the time of the AI-agent intrusion. Exploitation was first observed 9 hours 41 minutes after public disclosure of advisory GHSA-2679-6mx9-h9xc.

The agent connected to the marimo `/terminal/ws` endpoint at 18:23:44 UTC from origin IP 157.66.54.26 (AS141892, Indonesia) and issued `id` as its first command one second later.

## Phase 1 — Credential Harvest (18:24:14 UTC onward)

From the same Indonesian origin IP the agent ran a tightly-scoped, machine-parsed enumeration sweep against credential storage locations: `/app/.env*`, `/etc/environment`, `/proc/*/environ`, `~/.aws/credentials`, `~/.bash_history` (bounded with `tail -20`), `~/.pgpass`, `~/.gitconfig`, `/tmp/` listings, and a `find /home/deploy -type f \( -name '*.pem' -o -name '*.key' -o -name '*.env' \)` sweep. The agent additionally enumerated containers and SSH keys with `docker ps`, `docker images | head -10`, `ls -la ~/.ssh/id_ed25519*`, and `cat ~/.ssh/id_ed25519.pub`. Two cloud credentials and a `.pgpass` password were extracted in this phase. Each command used structured separators (`echo '---'`), explicit output caps (`head -N`, `tail -20`), discarded stderr (`2>/dev/null`), and disabled pagers (`-P pager=off`) — formatting optimized for machine parsing rather than human reading.

## Phase 2 — AWS Reconnaissance via Cloudflare Workers Egress Pool (19:26:31 UTC)

After a 48-minute gap (consistent with tooling transfer to an agent harness), the operator replayed the harvested AWS access key/secret through what Sysdig identifies as a Cloudflare Workers per-request egress pool inside the 104.28.0.0/16 range (AS13335). Twelve AWS API calls — `sts:GetCallerIdentity`, `secretsmanager:ListSecrets`, and `secretsmanager:GetSecretValue` — were fanned across eleven distinct Cloudflare Workers points-of-presence within 22 seconds. Observed Workers IPs included 104.28.162.160, 104.28.165.251, 104.28.165.169, and 104.28.157.50. The eleven-IP, 22-second burst pattern is the structural signature of Cloudflare Workers being abused as a programmatic egress pool: no single source IP exceeds the rate or volume threshold of typical per-IP detections.

The `ListSecrets` response was consumed by the agent and the specific secret ID for the SSH private key was selected and retrieved roughly twenty seconds later — a live output-chaining behavior characteristic of an LLM driving its own reconnaissance.

## Phase 3 — SSH Bastion Access (19:30:30 UTC)

The SSH private key retrieved from AWS Secrets Manager was used to authenticate to a downstream bastion host. Within 113 seconds the agent opened eight parallel SSH sessions originating from six distinct Cloudflare Workers source IPs, defeating per-source-IP login-velocity alerting on the bastion.

## Phase 4 — PostgreSQL Schema Enumeration and Exfiltration (19:31:53 — 19:32:23 UTC)

The agent immediately enumerated the target schema with `SELECT tablename FROM pg_tables WHERE schemaname='public'` against `internal-db` as user `app`. It then ran a `SELECT * FROM credential LIMIT 40` improvisation against a credential table whose existence had not been confirmed by prior reconnaissance — Sysdig flags this as a key LLM tell: the agent reasoned from general application-schema knowledge rather than staged intelligence. The same source IP block (104.28.165.251) was used for the targeted credential dump.

The agent finished with a multi-table HEREDOC dump against the application database:

``` PGPASSWORD=<harvested> psql -h internal-db -U app -d app -P pager=off << 'EOF' SELECT * FROM api_key; SELECT * FROM credential; SELECT * FROM "user"; SELECT * FROM variable; SELECT * FROM flow; SELECT * FROM message; EOF ```

Tables `api_key`, `credential`, `user`, `variable`, `flow`, and `message` were exfiltrated. The full SSH/exfil phase completed in under two minutes; the full chain from initial RCE to last exfil command completed in under one hour.

## LLM Orchestration Indicators

Sysdig identifies four forensic signatures of LLM-driven automation in this incident:

1. **Schema improvisation** — The agent enumerated tables and immediately queried a credential table without prior knowledge of its existence, reasoning from general application priors rather than from observed intelligence. 2. **Internal monologue leak** — A Chinese-language planning comment, `看还能做什么` (translation: "see what else we can do"), appeared in the command stream across six distinct IPs at sub-second cadence — inconsistent with human typing or static script execution. The presence of Chinese characters suggests a Chinese-language tooling layer or operator-language prompt, though attribution remains LOW confidence. 3. **Machine-parsed output construction** — Every command used structured separators (`echo '---'`), bounded output (`head -N`), discarded error streams (`2>/dev/null`), and disabled pagers (`-P pager=off`), enabling clean parsing of stdout by the agent harness. 4. **Live output chaining** — Database passwords were sourced from `.pgpass` files read moments earlier; SSH key paths were confirmed against prior `ls` output; AWS secret IDs were selected from `ListSecrets` responses just twenty seconds before retrieval. The agent fed its own prior outputs into subsequent actions without human intervention.

## Attribution

Attribution is LOW confidence. The origin IP 157.66.54.26 resolves to AS141892 in Indonesia. The Cloudflare Workers fan-out indicates programmatic abuse of the Workers platform for traffic distribution. The Chinese-language planning comment is the strongest attribution signal but is consistent with multiple hypotheses: a Chinese-speaking operator, a Chinese-language LLM service used as the agent backbone, or a deliberate false flag. No cluster or named threat actor has been linked to this intrusion at time of publication.

## Significance

Sysdig Sr. Director Michael Clark summarized the operational implication: "We are not watching AI replace attackers. We are watching attackers replace their scripts with AI." The incident validates a class of defensive failure modes: per-source-IP correlation, login-velocity thresholds, and signature-based command detection are individually evadable by a competent LLM driving widely distributed egress. Behavioral detection on credential access, Secrets Manager fan-out, and multi-IP SSH session bursts becomes the load-bearing control.