{"schema_version":"0.10.0","id":"LR-2026-0581","record_version":1,"title":"Marimo notebook flaw (CVE-2026-39987) exploited in LLM-agent-driven intrusion","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"8ece68b63236d28a88199d346b3f0ae3cdd06fc5fd8c14262f966b75016161c1"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-05-10","date_disclosed":"2026-06-01","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A threat actor exploited CVE-2026-39987, a critical flaw in the open-source Marimo notebook, on an internet-exposed instance, and an LLM agent drove the post-exploitation phase. The flaw is a missing authentication issue on Marimo's terminal endpoint. The agent harvested cloud credentials from environment files and AWS credential stores, used them to retrieve an SSH key from AWS Secrets Manager, and used that key to open parallel SSH sessions against a downstream bastion server. From there an internal PostgreSQL database was exfiltrated in under two minutes. Researchers identified machine-paced command patterns, including a planning comment in the command stream, that indicated the agent's role. Researchers published findings on May 28, 2026 about an intrusion observed on May 10, 2026.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["J1"],"quote":"Start with an update of a vulnerable Marimo instance to remove the unauthenticated terminal endpoint.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["A3"],"quote":"Eliminate locally stored cloud keys, database passwords, and SSH keys, replacing them with short-lived credentials issued through a centralized secrets manager.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["E4"],"quote":"Run Marimo and similar tools inside tightly restricted containers with limited network access so a compromised notebook cannot directly reach internal systems or cloud control planes.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["F2","F4"],"quote":"Deploy monitoring that flags rapid, machine-paced command sequences, bursts of cloud API calls, parallel SSH sessions, and unexpected database export activity.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. Fact: one internal PostgreSQL database was fully exfiltrated, a bounded scope; no count of affected parties is stated.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion","publisher":"Field Effect","date":"2026-06-01","type":"press","title":"Critical Marimo notebook flaw exploited in LLM-agent-driven intrusion - Field Effect","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.date_occurred":"C","event.agent_involved":"C","event.incident_class":"C","event.adversarial_actor":"C","impact.severity":"D","impact.severity_because":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent."}],"event.agent_involved":[{"source_index":0,"quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent."}],"event.incident_class":[{"source_index":0,"quote":"The threat actor exploited CVE-2026-39987 to gain a shell on an internet-exposed Marimo instance."}],"event.adversarial_actor":[{"source_index":0,"quote":"The threat actor exploited CVE-2026-39987 to gain a shell on an internet-exposed Marimo instance."}],"impact.severity":[{"source_index":0,"quote":"The key was then used to open eight parallel SSH sessions against a downstream bastion server, from which an internal PostgreSQL database was fully exfiltrated in under two minutes."}],"impact.severity_because":[{"source_index":0,"quote":"The key was then used to open eight parallel SSH sessions against a downstream bastion server, from which an internal PostgreSQL database was fully exfiltrated in under two minutes."}],"event.remediations":[{"source_index":0,"quote":"Start with an update of a vulnerable Marimo instance to remove the unauthenticated terminal endpoint."},{"source_index":0,"quote":"Eliminate locally stored cloud keys, database passwords, and SSH keys, replacing them with short-lived credentials issued through a centralized secrets manager."},{"source_index":0,"quote":"Run Marimo and similar tools inside tightly restricted containers with limited network access so a compromised notebook cannot directly reach internal systems or cloud control planes."},{"source_index":0,"quote":"Deploy monitoring that flags rapid, machine-paced command sequences, bursts of cloud API calls, parallel SSH sessions, and unexpected database export activity."}],"event.summary":[{"source_index":0,"quote":"The threat actor exploited CVE-2026-39987 to gain a shell on an internet-exposed Marimo instance."},{"source_index":0,"quote":"CVE-2026-39987 is a missing authentication flaw (CWE-306) in Marimo's terminal WebSocket endpoint at /terminal/ws."},{"source_index":0,"quote":"Cloud credentials were harvested from environment files and Amazon Web Services (AWS) credential stores."},{"source_index":0,"quote":"Those credentials were used to retrieve a Secure Shell (SSH) private key from AWS Secrets Manager."},{"source_index":0,"quote":"The key was then used to open eight parallel SSH sessions against a downstream bastion server, from which an internal PostgreSQL database was fully exfiltrated in under two minutes."},{"source_index":0,"quote":"A Chinese-language planning comment appeared in the command stream at sub-second pace across six IP addresses"},{"source_index":0,"quote":"Every command was formatted for machine consumption with structured separators and discarded error streams"},{"source_index":0,"quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent."}]},"notes_on_gaps":"Single press source (Field Effect, 2026-06-01) summarising researcher findings; the original researcher report is not provided. Not stated: the model name, version, developer and harness of the attacker's agent; the victim organisation, its industry and country; number of records or affected parties; direct loss and remediation hours; time to containment; date the activity was detected; whether the agent was fully autonomous (autonomy_level left out). The 'under one hour' total is stated only as an upper bound, so no duration was recorded. Judgements made: the threat actor is classed as external_attacker and third_party responsible party, inferred from 'threat actor'; root_cause set to infrastructure for the missing authentication on the terminal endpoint, the closest closed-list fit; trigger set to human_misuse because the source says the threat actor exploited the flaw; severity set to moderate because one victim's internal database was exfiltrated with a bounded scope, with no stated count of affected parties; control J3 marked failed as an inference from the attacker reaching the downstream bastion server, not an explicit source statement. No control was marked held. Remediation entries are advice from the press analysis, not fixes reported by a party. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A threat actor exploited a missing-authentication flaw in Marimo's terminal endpoint to gain a shell on an internet-exposed instance.","quote":"The threat actor exploited CVE-2026-39987 to gain a shell on an internet-exposed Marimo instance.","source_index":0,"grade":"C"},{"step":"done","text":"Researchers reported the incident on May 28, 2026, describing an LLM-agent-driven intrusion that exfiltrated an internal database.","quote":"On May 28, researchers reported an incident in which a threat actor used an LLM agent to harvest cloud credentials, move laterally, and exfiltrate an internal database in under one hour.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion"]},"analysis":{"sections":{"timeline":[{"text":"Security advisory for CVE-2026-39987 published on GitHub.","quote":"On April 8, 2026, the security advisory for CVE-2026-39987 was published on GitHub.","source_index":0,"when":"2026-04-08"},{"text":"Researchers observed the first exploitation attempt, with no public PoC available.","quote":"The next day, researchers reported having observed the first exploitation attempt, with no public proof-of-concept (PoC) code available at the time, and suggested the adversary built a working exploit directly from the advisory text.","source_index":0,"when":"2026-04-09"},{"text":"AI-agent-driven intrusion observed.","quote":"On May 28, 2026, researchers published findings on an AI-agent-driven intrusion observed on May 10, 2026, in which a threat actor exploited CVE-2026-39987, a critical remote code execution (RCE) vulnerability in Marimo, with the post-exploitation phase of this intrusion driven by a large language model (LLM) agent.","source_index":0,"when":"2026-05-10"},{"text":"Researchers reported the incident.","quote":"On May 28, researchers reported an incident in which a threat actor used an LLM agent to harvest cloud credentials, move laterally, and exfiltrate an internal database in under one hour.","source_index":0,"when":"2026-05-28"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://fieldeffect.com/blog/marimo-flaw-exploited-llm-agent-intrusion"]}}