AI Risk Wire

Cases › security breach › LR-2026-0550

Attackers use LLM agent for post-exploitation after Marimo exploit

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: no action reported

Severity moderate
Reported 28 May 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: test: data of others touched with a bounded scope stated, namely the full contents of an internal PostgreSQL database.

An unknown threat actor used a large language model agent to carry out post-compromise actions after gaining initial access to an internet-reachable Marimo notebook through CVE-2026-39987, a missing-authentication flaw in its terminal endpoint. The agent harvested cloud credentials, retrieved an SSH private key from AWS Secrets Manager, and used it against a downstream SSH bastion server, from which an internal PostgreSQL database was exfiltrated in under two minutes. Sysdig uncovered indicators that an LLM agent drove the post-exploitation work, including improvised database access without prior schema knowledge and machine-formatted commands. The vendor had addressed the flaw in version 0.23.0. Sources recommend updating Marimo, auditing exposed instances and rotating credentials.

What happened

1 · What it was doingAn unknown threat actor used an LLM agent for post-compromise actions after initial access.
2 · What went wrongAn unauthenticated terminal endpoint in Marimo was exploitable.
3 · How it was caughtSysdig identified indicators that an LLM agent drove the activity.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 3 items from the primary sources

What happened, in order

  1. 2026-04-08 Security advisory for CVE-2026-39987 published on GitHub.
  2. 2026-05-28 Researchers published findings on the LLM-agent-driven intrusion.

Not dated in the sources:

  • End-to-end attack chain lasted a little over an hour.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-05-28
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
What went wrong
security breach
C one secondary source states it

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Why this severity
test: data of others touched with a bounded scope stated, namely the full contents of an internal PostgreSQL database.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Control J2 and A3 outcomes as missing are my inference from the flaw description and the advice; the sources do not explicitly say these controls were absent. The post-hoc advice to deploy monitoring and rate limits is not linked as a control because no source says those controls were present or missing in this incident.

LR-2026-0550 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON