---
schema: 1
kind: research
title: "Sysdig TRT: first observed LLM-agent-driven post-exploitation — CVE-2026-39987 Marimo notebook RCE to database exfiltration in 4 pivots under one hour"
headline: "Sysdig TRT: first observed LLM-agent-driven post-exploitation — CVE-2026-39987 Marimo notebook RCE to database exfiltration in 4 pivots under one hour"
summary: "Sysdig's Threat Research Team documented what they assess as the first in-the-wild LLM-agent-driven intrusion, observed on 10 May 2026 (Sysdig TRT, 2026-05-26; The Hacker News, 2026-05-29)."
discovered_at: "2026-05-30T05:00:08Z"
event_date: 2026-05-29
run_id: 2026-05-30-aca445cc
priority: notable
immediate_action: null
tags:
  - vulnerabilities
  - ai-abuse
  - cloud
regions:
  - global
sectors:
  - technology
entities: []
cves: []
sources:
  - url: "https://www.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots"
    publisher: Sysdig TRT
    role: primary
  - url: "https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html"
    publisher: The Hacker News
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-05-30.md
---

Sysdig's Threat Research Team documented what they assess as the first in-the-wild LLM-agent-driven intrusion, observed on 10 May 2026 ([Sysdig TRT, 2026-05-26](https://www.sysdig.com/blog/ai-agent-at-the-wheel-how-an-attacker-used-llms-to-move-from-a-cve-to-an-internal-database-in-4-pivots); [The Hacker News, 2026-05-29](https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html)). Initial access: exploitation of CVE-2026-39987, a pre-auth RCE in Marimo notebook < 0.20.4 (patched in 0.23.0) on an internet-accessible instance (T1190). An AI agent then drove four autonomous pivots: (1) extracted two cloud credentials from the host filesystem (T1552.001); (2) replayed them via a Cloudflare Workers egress pool to call AWS Secrets Manager APIs and retrieve an SSH private key (T1555); (3) executed eight parallel SSH sessions against a downstream bastion (T1021.004); (4) exfiltrated the full schema and contents of a downstream PostgreSQL database within two minutes (T1048). Sysdig identified LLM agent involvement from four artefacts: improvised schema discovery without environmental foreknowledge; a Chinese-language planning comment in the command stream ("看还能做什么" — "See what else we can do"); machine-optimised command formatting (delimiter-separated, bounded output, stderr discarded, `less` disabled); and sequential hand-off of output values as inputs to subsequent commands. Cloudflare Workers obscured the origin IP. No attribution was made. Defender countermeasures: update Marimo to ≥ 0.23.0; restrict internet-accessible notebook deployments; monitor AWS CloudTrail for Secrets Manager `GetSecretValue` calls from unexpected IPs; restrict SSH bastion access to known CIDR ranges.