{"schema_version":"0.10.0","id":"LR-2026-0550","record_version":1,"title":"Attackers use LLM agent for post-exploitation after Marimo exploit","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"7c0614590ef346e85f87e39c1100b44d3bb0a8ed93cba12305c9544d5c2226f3"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-28","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"An unknown threat actor used a large language model agent to carry out post-compromise actions after gaining initial access to an internet-reachable Marimo notebook through CVE-2026-39987, a missing-authentication flaw in its terminal endpoint. The agent harvested cloud credentials, retrieved an SSH private key from AWS Secrets Manager, and used it against a downstream SSH bastion server, from which an internal PostgreSQL database was exfiltrated in under two minutes. Sysdig uncovered indicators that an LLM agent drove the post-exploitation work, including improvised database access without prior schema knowledge and machine-formatted commands. The vendor had addressed the flaw in version 0.23.0. Sources recommend updating Marimo, auditing exposed instances and rotating credentials.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: data of others touched with a bounded scope stated, namely the full contents of an internal PostgreSQL database.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html","publisher":"The Hacker News","date":"2026-05-29","type":"press","title":"Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion","publisher":"Field Effect","date":"2026-06-01","type":"press","title":"Critical Marimo notebook flaw exploited in LLM-agent-driven intrusion - Field Effect","archived_url":null}],"per_field_confidence":{"event.incident_class":"C","event.date_disclosed":"C","event.detection_method":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability."}],"event.date_disclosed":[{"source_index":1,"quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent."}],"event.detection_method":[{"source_index":0,"quote":"Sysdig said it uncovered four indicators that an LLM agent was behind the activity."}],"impact.severity":[{"source_index":0,"quote":"The bastion phase exfiltrated the schema and full contents of an internal PostgreSQL database in under two minutes."}],"impact.severity_because":[{"source_index":0,"quote":"The bastion phase exfiltrated the schema and full contents of an internal PostgreSQL database in under two minutes."}],"event.summary":[{"source_index":1,"quote":"The threat actor exploited CVE-2026-39987 to gain a shell on an internet-exposed Marimo instance."},{"source_index":1,"quote":"CVE-2026-39987 is a missing authentication flaw (CWE-306) in Marimo's terminal WebSocket endpoint at /terminal/ws."},{"source_index":1,"quote":"Cloud credentials were harvested from environment files and Amazon Web Services (AWS) credential stores."},{"source_index":1,"quote":"The key was then used to open eight parallel SSH sessions against a downstream bastion server, from which an internal PostgreSQL database was fully exfiltrated in under two minutes."},{"source_index":0,"quote":"Sysdig said it uncovered four indicators that an LLM agent was behind the activity."},{"source_index":0,"quote":"The issue was addressed in version 0.23.0, released last month."},{"source_index":0,"quote":"To counter this threat, it's recommended that users update to the latest version of Marimo, audit environments for any publicly-accessible instances, and rotate credentials, API keys, and SSH keys."}]},"notes_on_gaps":"No source states the system model, developer, harness or permissions of the attacker's agent, so no system fields are given. The sources do not state records exposed, loss amounts, number of affected parties, the attacker's identity, or the detection date. Duration is not given as a number because sources say only 'under one hour' and 'a little over an hour'. The event.trigger is left out because no source states the cause of entry beyond the vulnerability. Root cause as guardrail is my judgement that a missing authentication check is a missing guardrail. Control J2 and A3 outcomes as missing are my inference from the flaw description and the advice; the sources do not explicitly say these controls were absent. The post-hoc advice to deploy monitoring and rate limits is not linked as a control because no source says those controls were present or missing in this incident. The 'next day' timeline entry has no stated date, so when is null. Severity moderate is my judgement from a bounded scope; the sources do not state a count of affected parties. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An unknown threat actor used an LLM agent for post-compromise actions after initial access.","quote":"An unknown threat actor has been observed using a large language model (LLM) agent to conduct post-compromise actions after obtaining initial access following the exploitation of a publicly-accessible Marimo network using a recently disclosed vulnerability.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"An unauthenticated terminal endpoint in Marimo was exploitable.","quote":"CVE-2026-39987 is a missing authentication flaw (CWE-306) in Marimo's terminal WebSocket endpoint at /terminal/ws.","source_index":1,"grade":"C"},{"step":"caught","text":"Sysdig identified indicators that an LLM agent drove the activity.","quote":"Sysdig said it uncovered four indicators that an LLM agent was behind the activity.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html","https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion"]},"analysis":{"sections":{"timeline":[{"text":"Security advisory for CVE-2026-39987 published on GitHub.","quote":"On April 8, 2026, the security advisory for CVE-2026-39987 was published on GitHub.","source_index":1,"when":"2026-04-08"},{"text":"End-to-end attack chain lasted a little over an hour.","quote":"The end-to-end attack chain lasted a little over an hour.","source_index":0,"when":null},{"text":"Researchers published findings on the LLM-agent-driven intrusion.","quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent.","source_index":1,"when":"2026-05-28"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html","https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion"]}}