Cases › security breach › LR-2026-0581

Marimo notebook flaw (CVE-2026-39987) exploited in LLM-agent-driven intrusion

Preliminary Why: Publisher not yet named · subject to change

Status: advice only, no fix reported

Severity moderate

Reported 1 Jun 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: Test: data or systems of others touched with a bounded scope stated. Fact: one internal PostgreSQL database was fully exfiltrated, a bounded scope; no count of affected parties is stated.

A threat actor exploited CVE-2026-39987, a critical flaw in the open-source Marimo notebook, on an internet-exposed instance, and an LLM agent drove the post-exploitation phase. The flaw is a missing authentication issue on Marimo's terminal endpoint. The agent harvested cloud credentials from environment files and AWS credential stores, used them to retrieve an SSH key from AWS Secrets Manager, and used that key to open parallel SSH sessions against a downstream bastion server. From there an internal PostgreSQL database was exfiltrated in under two minutes. Researchers identified machine-paced command patterns, including a planning comment in the command stream, that indicated the agent's role. Researchers published findings on May 28, 2026 about an intrusion observed on May 10, 2026.

What happened

1 · What went wrongA threat actor exploited a missing-authentication flaw in Marimo's terminal endpoint to gain a shell on an internet-exposed instance.

What was done

Researchers reported the incident on May 28, 2026, describing an LLM-agent-driven intrusion that exfiltrated an internal database.

Advice in source, not a fix by the party

“Start with an update of a vulnerable Marimo instance to remove the unauthenticated terminal endpoint.”

Known flaws patched

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week

AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: what the AI was doing, what it reached or did, how it was caught, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 4 items from the primary sources

What happened, in order

2026-04-08 Security advisory for CVE-2026-39987 published on GitHub.
2026-04-09 Researchers observed the first exploitation attempt, with no public PoC available.
2026-05-10 AI-agent-driven intrusion observed.
2026-05-28 Researchers reported the incident.

Show every field, with its source and grade