Sysdig TRT: first observed LLM-agent-driven post-exploitation — CVE-2026-39987 Marimo notebook RCE to database exfiltration in 4 pivots under one hour
Sysdig's Threat Research Team documented what they assess as the first in-the-wild LLM-agent-driven intrusion, observed on 10 May 2026 (Sysdig TRT, 2026-05-26; The Hacker News, 2026-05-29). Initial access: exploitation of CVE-2026-39987, a pre-auth RCE in Marimo notebook < 0.20.4 (patched in 0.23.0) on an internet-accessible instance (T1190). An AI agent then drove four autonomous pivots: (1) extracted two cloud credentials from the host filesystem (T1552.001); (2) replayed them via a Cloudflare Workers egress pool to call AWS Secrets Manager APIs and retrieve an SSH private key (T1555); (3) executed eight parallel SSH sessions against a downstream bastion (T1021.004); (4) exfiltrated the full schema and contents of a downstream PostgreSQL database within two minutes (T1048). Sysdig identified LLM agent involvement from four artefacts: improvised schema discovery without environmental foreknowledge; a Chinese-language planning comment in the command stream ("看还能做什么" — "See what else we can do"); machine-optimised command formatting (delimiter-separated, bounded output, stderr discarded, less disabled); and sequential hand-off of output values as inputs to subsequent commands. Cloudflare Workers obscured the origin IP. No attribution was made. Defender countermeasures: update Marimo to ≥ 0.23.0; restrict internet-accessible notebook deployments; monitor AWS CloudTrail for Secrets Manager GetSecretValue calls from unexpected IPs; restrict SSH bastion access to known CIDR ranges.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
T1555Credentials from Password Stores
Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Lateral Movement TA0008
T1021.004Remote Services: SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
Exfiltration TA0010
T1048Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.