{"schema_version":"0.10.0","id":"LR-2026-0547","record_version":1,"title":"AI agent intrusion in the wild steals database in under an hour","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: securitymagazine.com · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: securitymagazine.com · subject to change"}]},"sources_hash":"d746ce442831044aa20816d348925e9281455afe5304f2eb6344c88c83cd9a4f"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-05-10","date_disclosed":"2026-05-28","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"human_misuse","duration":null,"detection_method":"third_party","summary":"Sysdig's Threat Research Team documented an intrusion observed on May 10, 2026 in which a large language model agent acted as the autonomous operator of a post-exploitation chain. The attacker first exploited a vulnerable marimo notebook to gain code execution, then harvested AWS credentials from the compromised workload. Using those credentials, the agent found an SSH key in AWS Secrets Manager, used it to reach an SSH jump host, and exfiltrated the contents of a reachable PostgreSQL database. The whole chain ran in under one hour. The activity was caught by Sysdig's researchers and reported in the press. The notebook flaw, CVE-2026-39987, was patched in version 0.23.0 and is listed in CISA's Known Exploited Vulnerabilities catalog.","tags":["marimo","cve-2026-39987"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK03","RK04"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["J1"],"quote":"The operational implication of the Sysdig attack is not primarily about patching Marimo — though any organization still running versions of Marimo 0.20.4 or earlier needs to update to 0.23.0 immediately and rotate every credential, API key, and SSH key that was accessible from that environment.","source_index":1,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["F2"],"quote":"What survives this shift is behavioral detection built around what the attacker is trying to accomplish — reading credentials, enumerating secrets, escalating to a bastion, exfiltrating a database — rather than the specific sequence of commands used.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope. Fact: the full contents of one internal PostgreSQL database were dumped; no count of affected parties is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.securitymagazine.com/articles/102325-ai-agent-conducted-a-cyberattack-on-its-own-it-took-less-than-one-hour","publisher":"Security Magazine","date":"2026-05-28","type":"press","title":"AI Agent Conducted a Cyberattack on Its Own — It Took Less Than One Hour - Security Magazine","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.techtimes.com/articles/317423/20260530/ai-vs-ai-cybersecurity-sysdig-documents-first-llm-agent-intrusion-wild.htm","publisher":"Tech Times","date":"2026-05-30","type":"press","title":"AI vs AI Cybersecurity: Sysdig Documents First LLM-Agent Intrusion in the Wild - Tech Times","archived_url":null,"independence":"derivative"}],"per_field_confidence":{"system.autonomy_level":"C","event.incident_class":"C","event.agent_involved":"C","event.trigger":"C","event.detection_method":"C","event.date_occurred":"C","event.date_disclosed":"C","event.tags":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.deployment_context":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"system.autonomy_level":[{"source_index":1,"quote":"In it, an unknown attacker ran a large language model agent against a target's infrastructure — not as an assistant, not as a co-pilot, but as the autonomous operator of a complete intrusion chain."}],"event.incident_class":[{"source_index":0,"quote":"“In this intrusion, the attacker exploited a vulnerable marimo notebook to gain code execution,” Michael Clark, Senior Director of Threat Research at Sysdig told Security magazine."}],"event.agent_involved":[{"source_index":1,"quote":"In it, an unknown attacker ran a large language model agent against a target's infrastructure — not as an assistant, not as a co-pilot, but as the autonomous operator of a complete intrusion chain."}],"event.trigger":[{"source_index":1,"quote":"In it, an unknown attacker ran a large language model agent against a target's infrastructure — not as an assistant, not as a co-pilot, but as the autonomous operator of a complete intrusion chain."}],"event.detection_method":[{"source_index":0,"quote":"This event was observed by the Sysdig Threat Research Team (TRT) on May 10, 2026."}],"event.date_occurred":[{"source_index":1,"quote":"On May 28, Security Magazine published an interview with Michael Clark, Director of Threat Research at Sysdig, about a documented intrusion his team captured on May 10, 2026."}],"event.date_disclosed":[{"source_index":1,"quote":"On May 28, Security Magazine published an interview with Michael Clark, Director of Threat Research at Sysdig, about a documented intrusion his team captured on May 10, 2026."}],"event.tags":[{"source_index":1,"quote":"The incident Sysdig captured on May 10 began with CVE-2026-39987, a critical pre-authentication remote code execution vulnerability in Marimo, an open-source Python notebook used widely by AI researchers and data scientists."}],"impact.severity":[{"source_index":1,"quote":"It opened eight parallel SSH sessions against a downstream bastion server and dumped the full contents of an internal PostgreSQL database in under two minutes."}],"impact.severity_because":[{"source_index":1,"quote":"It opened eight parallel SSH sessions against a downstream bastion server and dumped the full contents of an internal PostgreSQL database in under two minutes."}],"event.remediations":[{"source_index":1,"quote":"The operational implication of the Sysdig attack is not primarily about patching Marimo — though any organization still running versions of Marimo 0.20.4 or earlier needs to update to 0.23.0 immediately and rotate every credential, API key, and SSH key that was accessible from that environment."},{"source_index":1,"quote":"What survives this shift is behavioral detection built around what the attacker is trying to accomplish — reading credentials, enumerating secrets, escalating to a bastion, exfiltrating a database — rather than the specific sequence of commands used."}],"event.summary":[{"source_index":0,"quote":"This event was observed by the Sysdig Threat Research Team (TRT) on May 10, 2026."},{"source_index":0,"quote":"“In this intrusion, the attacker exploited a vulnerable marimo notebook to gain code execution,” Michael Clark, Senior Director of Threat Research at Sysdig told Security magazine."},{"source_index":0,"quote":"Then, they harvested data from the compromised workload, including AWS credentials."},{"source_index":0,"quote":"Using those credentials, the attackers performed reconnaissance across the AWS environment and discovered an SSH key in AWS Secrets Manager."},{"source_index":0,"quote":"They used the stolen key to access an SSH jump, where they found a reachable PostgreSQL database and exfiltrated its contents."},{"source_index":0,"quote":"The entire attack chain ran end-to-end in less than one hour."},{"source_index":1,"quote":"Marimo's maintainers patched it in version 0.23.0, but the window was already open — Sysdig had recorded the vulnerability being exploited within nine hours and 41 minutes of its first public disclosure, and between April 11 and April 14 alone, 662 distinct exploit events targeted it from 11 IP addresses across 10 countries."}]},"notes_on_gaps":"The sources do not state records exposed, affected party counts, direct loss, remediation hours, the victim's industry or country, the victim's identity, or the model name, version or developer. The duration 'less than one hour' and 'under two minutes' are quoted as bounds, not converted to ISO durations. No detection date beyond the Sysdig observation date was stated, so date_detected is omitted. The adversary is described only as unknown, so adversarial_actor is set to unknown and responsible_party is omitted. The autonomy_level of full-auto is my judgement from the source's claim that the agent made every post-exploitation decision and no human typed a command. The root_cause of infrastructure is my judgement that the exposed notebook endpoint is the failed element. The A4 link (secrets kept out of model context) is my judgement that harvesting credentials from environment files shows that control failing; the sources do not name it. The J1 link is inferred from the patch being released after exploitation began. No control outcome for the per-source-IP detection was recorded because no listed control clearly matches it. The severity tier moderate is my judgement from one target's database being touched with a bounded scope. The harm_class third_party_security is my judgement from the exfiltration of the target's database. Sysdig is a security vendor reporting its own observation, and the Security Magazine and Tech Times pieces are press reports. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: securitymagazine.com · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An LLM agent made the post-exploitation decisions on its own, acting as the autonomous operator of the intrusion.","quote":"The agent made every post-exploitation decision on its own.","source_index":1,"grade":"C"},{"step":"went_wrong","text":"An exposed marimo notebook endpoint with a code execution flaw gave the attacker an interactive shell.","quote":"The flaw required no exploit kit: a single WebSocket request to an exposed endpoint produced a fully interactive shell.","source_index":1,"grade":"C"},{"step":"reached","text":"The agent opened parallel SSH sessions to a bastion server and dumped an internal PostgreSQL database.","quote":"It opened eight parallel SSH sessions against a downstream bastion server and dumped the full contents of an internal PostgreSQL database in under two minutes.","source_index":1,"grade":"C"},{"step":"caught","text":"Sysdig's Threat Research Team observed and documented the intrusion.","quote":"This event was observed by the Sysdig Threat Research Team (TRT) on May 10, 2026.","source_index":0,"grade":"C"},{"step":"done","text":"The full attack chain ran end-to-end in under one hour.","quote":"The entire attack chain ran end-to-end in less than one hour.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.securitymagazine.com/articles/102325-ai-agent-conducted-a-cyberattack-on-its-own-it-took-less-than-one-hour","https://www.techtimes.com/articles/317423/20260530/ai-vs-ai-cybersecurity-sysdig-documents-first-llm-agent-intrusion-wild.htm"]},"analysis":{"sections":{"timeline":[{"text":"Exploitation attempts against the marimo vulnerability were recorded before the intrusion.","quote":"Marimo's maintainers patched it in version 0.23.0, but the window was already open — Sysdig had recorded the vulnerability being exploited within nine hours and 41 minutes of its first public disclosure, and between April 11 and April 14 alone, 662 distinct exploit events targeted it from 11 IP addresses across 10 countries.","source_index":1,"when":"2026-04-11 to 2026-04-14"},{"text":"The intrusion was observed by the Sysdig Threat Research Team.","quote":"This event was observed by the Sysdig Threat Research Team (TRT) on May 10, 2026.","source_index":0,"when":"2026-05-10"},{"text":"The attack chain ran end-to-end in less than one hour.","quote":"The entire attack chain ran end-to-end in less than one hour.","source_index":0,"when":null},{"text":"The agent harvested two cloud credentials from environment files.","quote":"It harvested two cloud credentials from environment files.","source_index":1,"when":null},{"text":"The agent opened eight parallel SSH sessions to a downstream bastion and dumped an internal PostgreSQL database.","quote":"It opened eight parallel SSH sessions against a downstream bastion server and dumped the full contents of an internal PostgreSQL database in under two minutes.","source_index":1,"when":null},{"text":"Security Magazine published an interview with Sysdig's threat research director about the intrusion.","quote":"On May 28, Security Magazine published an interview with Michael Clark, Director of Threat Research at Sysdig, about a documented intrusion his team captured on May 10, 2026.","source_index":1,"when":"2026-05-28"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.securitymagazine.com/articles/102325-ai-agent-conducted-a-cyberattack-on-its-own-it-took-less-than-one-hour","https://www.techtimes.com/articles/317423/20260530/ai-vs-ai-cybersecurity-sysdig-documents-first-llm-agent-intrusion-wild.htm"]}}