# First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion → Internal PostgreSQL Exfiltration (Sysdig TRT, 2026-05-10)

> On 2026-05-10, Sysdig Threat Research Team observed what it describes as the first AI-agent-driven cloud intrusion captured in the wild: an autonomous LLM agent chained a pre-auth marimo notebook WebSocket RCE (CVE-2026-39987) into an AWS credential harvest, a Secrets Manager SSH-key retrieval, and eight parallel bastion SSH sessions that exfiltrated an internal PostgreSQL database end-to-end in under one hour. Twelve AWS API calls fanned across eleven Cloudflare Workers egress IPs in 22 seconds and eight SSH sessions originated from six distinct source IPs simultaneously — defeating per-source-IP correlation. A Chinese-language planning comment ("看还能做什么" — "see what else we can do") leaked into the command stream at sub-second cadence across multiple IPs, providing forensic evidence of LLM orchestration rather than a human operator or static script.

- **Published:** 2026-05-28T18:25:48Z
- **Last reviewed:** 2026-05-28T18:25:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0619
- **ID:** TL-2026-0619
- **Severity:** HIGH (CVSS 9.3)
- **Category:** CLOUD
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-39987

## Description

## Overview

On 2026-05-10, the Sysdig Threat Research Team (TRT) captured an intrusion in which an autonomous Large Language Model (LLM) agent executed the full post-exploitation chain following exploitation of CVE-2026-39987, a pre-authenticated WebSocket RCE in the marimo notebook server. Sysdig characterizes this as the first AI-agent-driven cloud intrusion observed in the wild — the entire chain from initial RCE through full PostgreSQL database exfiltration completed in under one hour, with the post-pivot SSH/exfil phase running in under two minutes.

The campaign is distinct from the broader April 2026 NKAbuse/`kagent` botnet campaign that Sysdig had previously documented against the same CVE; rather than dropping a persistent implant, the operator behind the 2026-05-10 incident chose to perform live, hands-off-keyboard data theft using an LLM agent driving an interactive shell.

## Initial Access — CVE-2026-39987

CVE-2026-39987 is a pre-authenticated Remote Code Execution in marimo's `/terminal/ws` WebSocket endpoint affecting all versions through 0.20.4 and fixed in 0.23.0. Where other WebSocket endpoints invoke marimo's authentication helpers, `/terminal/ws` only checks running-mode and platform-support flags before accepting the connection, completely skipping authentication. An unauthenticated remote attacker can therefore connect, obtain a full interactive PTY shell, and execute arbitrary OS commands as the marimo process user. The vulnerability carries a CVSS v3.1 base score of 9.3 (CRITICAL) and was added to the CISA KEV catalog on 2026-04-23 with a federal remediation deadline of 2026-05-07 — which had passed by the time of the AI-agent intrusion. Exploitation was first observed 9 hours 41 minutes after public disclosure of advisory GHSA-2679-6mx9-h9xc.

The agent connected to the marimo `/terminal/ws` endpoint at 18:23:44 UTC from origin IP 157.66.54.26 (AS141892, Indonesia) and issued `id` as its first command one second later.

## Phase 1 — Credential Harvest (18:24:14 UTC onward)

From the same Indonesian origin IP the agent ran a tightly-scoped, machine-parsed enumeration sweep against credential storage locations: `/app/.env*`, `/etc/environment`, `/proc/*/environ`, `~/.aws/credentials`, `~/.bash_history` (bounded with `tail -20`), `~/.pgpass`, `~/.gitconfig`, `/tmp/` listings, and a `find /home/deploy -type f \( -name '*.pem' -o -name '*.key' -o -name '*.env' \)` sweep. The agent additionally enumerated containers and SSH keys with `docker ps`, `docker images | head -10`, `ls -la ~/.ssh/id_ed25519*`, and `cat ~/.ssh/id_ed25519.pub`. Two cloud credentials and a `.pgpass` password were extracted in this phase. Each command used structured separators (`echo '---'`), explicit output caps (`head -N`, `tail -20`), discarded stderr (`2>/dev/null`), and disabled pagers (`-P pager=off`) — formatting optimized for machine parsing rather than human reading.

## Phase 2 — AWS Reconnaissance via Cloudflare Workers Egress Pool (19:26:31 UTC)

After a 48-minute gap (consistent with tooling transfer to an agent harness), the operator replayed the harvested AWS access key/secret through what Sysdig identifies as a Cloudflare Workers per-request egress pool inside the 104.28.0.0/16 range (AS13335). Twelve AWS API calls — `sts:GetCallerIdentity`, `secretsmanager:ListSecrets`, and `secretsmanager:GetSecretValue` — were fanned across eleven distinct Cloudflare Workers points-of-presence within 22 seconds. Observed Workers IPs included 104.28.162.160, 104.28.165.251, 104.28.165.169, and 104.28.157.50. The eleven-IP, 22-second burst pattern is the structural signature of Cloudflare Workers being abused as a programmatic egress pool: no single source IP exceeds the rate or volume threshold of typical per-IP detections.

The `ListSecrets` response was consumed by the agent and the specific secret ID for the SSH private key was selected and retrieved roughly twenty seconds later — a live output-chaining behavior characteristic of an LLM driving its own reconnaissance.

## Phase 3 — SSH Bastion Access (19:30:30 UTC)

The SSH private key retrieved from AWS Secrets Manager was used to authenticate to a downstream bastion host. Within 113 seconds the agent opened eight parallel SSH sessions originating from six distinct Cloudflare Workers source IPs, defeating per-source-IP login-velocity alerting on the bastion.

## Phase 4 — PostgreSQL Schema Enumeration and Exfiltration (19:31:53 — 19:32:23 UTC)

The agent immediately enumerated the target schema with `SELECT tablename FROM pg_tables WHERE schemaname='public'` against `internal-db` as user `app`. It then ran a `SELECT * FROM credential LIMIT 40` improvisation against a credential table whose existence had not been confirmed by prior reconnaissance — Sysdig flags this as a key LLM tell: the agent reasoned from general application-schema knowledge rather than staged intelligence. The same source IP block (104.28.165.251) was used for the targeted credential dump.

The agent finished with a multi-table HEREDOC dump against the application database:

```
PGPASSWORD=<harvested> psql -h internal-db -U app -d app -P pager=off << 'EOF'
SELECT * FROM api_key;
SELECT * FROM credential;
SELECT * FROM "user";
SELECT * FROM variable;
SELECT * FROM flow;
SELECT * FROM message;
EOF
```

Tables `api_key`, `credential`, `user`, `variable`, `flow`, and `message` were exfiltrated. The full SSH/exfil phase completed in under two minutes; the full chain from initial RCE to last exfil command completed in under one hour.

## LLM Orchestration Indicators

Sysdig identifies four forensic signatures of LLM-driven automation in this incident:

1. **Schema improvisation** — The agent enumerated tables and immediately queried a credential table without prior knowledge of its existence, reasoning from general application priors rather than from observed intelligence.
2. **Internal monologue leak** — A Chinese-language planning comment, `看还能做什么` (translation: "see what else we can do"), appeared in the command stream across six distinct IPs at sub-second cadence — inconsistent with human typing or static script execution. The presence of Chinese characters suggests a Chinese-language tooling layer or operator-language prompt, though attribution remains LOW confidence.
3. **Machine-parsed output construction** — Every command used structured separators (`echo '---'`), bounded output (`head -N`), discarded error streams (`2>/dev/null`), and disabled pagers (`-P pager=off`), enabling clean parsing of stdout by the agent harness.
4. **Live output chaining** — Database passwords were sourced from `.pgpass` files read moments earlier; SSH key paths were confirmed against prior `ls` output; AWS secret IDs were selected from `ListSecrets` responses just twenty seconds before retrieval. The agent fed its own prior outputs into subsequent actions without human intervention.

## Attribution

Attribution is LOW confidence. The origin IP 157.66.54.26 resolves to AS141892 in Indonesia. The Cloudflare Workers fan-out indicates programmatic abuse of the Workers platform for traffic distribution. The Chinese-language planning comment is the strongest attribution signal but is consistent with multiple hypotheses: a Chinese-speaking operator, a Chinese-language LLM service used as the agent backbone, or a deliberate false flag. No cluster or named threat actor has been linked to this intrusion at time of publication.

## Significance

Sysdig Sr. Director Michael Clark summarized the operational implication: "We are not watching AI replace attackers. We are watching attackers replace their scripts with AI." The incident validates a class of defensive failure modes: per-source-IP correlation, login-velocity thresholds, and signature-based command detection are individually evadable by a competent LLM driving widely distributed egress. Behavioral detection on credential access, Secrets Manager fan-out, and multi-IP SSH session bursts becomes the load-bearing control.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1564 Hide Artifacts
- T1090.003 Multi-hop Proxy
- T1550.001 Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.003 Shell History
- T1552.004 Unsecured Credentials: Private Keys
- T1552.005 Cloud Instance Metadata API
- T1555.006 Cloud Secrets Management Stores
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1613 Container and Resource Discovery
- T1021.004 Remote Services: SSH
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1074.002 Data Staged: Remote Data Staging
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1102.002 Bidirectional Communication
- T1041 Exfiltration Over C2 Channel
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1565.001 Stored Data Manipulation

## Sources

- [AI agent at the wheel: How an attacker used LLMs to move from a CVE to an internal database in 4 pivots — Sysdig](https://webflow.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots)
- [CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace — Sysdig](https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface)
- [Hackers Use LLM Agent to Move From Marimo RCE to Internal Database in Four Pivots — Cyber Security News](https://cybersecuritynews.com/hackers-use-llm-agent-to-move-from-marimo-rce/)
- [Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure — The Hacker News](https://thehackernews.com/2026/04/marimo-rce-flaw-cve-2026-39987.html)
- [CVE-2026-39987: Marimo RCE exploited in hours after disclosure — Security Affairs](https://securityaffairs.com/190623/hacking/cve-2026-39987-marimo-rce-exploited-in-hours-after-disclosure.html)
- [Hackers Use LLM Agent to Pivot From marimo RCE to Internal Database — CyberPress](https://cyberpress.org/llm-agent-pivots-database/)
- [Hackers Pivot from marimo RCE to Internal Database Using LLM Agent — GBHackers](https://gbhackers.com/hackers-pivot-from-marimo-rce/)
- [Critical Marimo pre-auth RCE flaw now under active exploitation — BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-marimo-pre-auth-rce-flaw-now-under-active-exploitation/)
- [Marimo Pre-Auth RCE: AI Development Toolchain Under Attack — Cloud Security Alliance Lab Space](https://labs.cloudsecurityalliance.org/research/csa-research-note-marimo-rce-cve-2026-39987-ai-toolchain-202/)
- [Critical Marimo Flaw Exploited Hours After Public Disclosure — SecurityWeek](https://www.securityweek.com/critical-marimo-flaw-exploited-hours-after-public-disclosure/)
- [GitHub Security Advisory GHSA-2679-6mx9-h9xc — marimo pre-auth RCE on /terminal/ws](https://github.com/marimo-team/marimo/security/advisories/GHSA-2679-6mx9-h9xc)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-39987 entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0619