Autonomous LLM Agent Drained an Internal Database in 2 Minutes via Marimo CVE-2026-39987

An LLM agent post-exploitation attack is an intrusion where an artificial intelligence agent conducts the post-compromise phase autonomously, issuing commands and adapting based on real-time output rather than executing a fixed script.

CVE-2026-39987 is a critical pre-authenticated remote code execution vulnerability in marimo, an open-source Python reactive notebook platform used in data science, machine learning, and analytics workflows. The vulnerability resides in the /terminal/ws WebSocket endpoint, which marimo exposes for interactive terminal access inside the notebook environment. In versions 0.20.4 and earlier, this endpoint accepts connections without authentication, allowing any remote attacker to send arbitrary shell commands to the underlying server. The fixed version is marimo 0.23.0. CISA added CVE-2026-39987 to its Known Exploited Vulnerabilities catalog following confirmed active exploitation.

The four-pivot chain documented by Sysdig ran as follows:

Phase 1, Initial RCE (18:23:44 UTC). The attacker connected to /terminal/ws from IP 157.66.54.26 (AS141892, Indonesia) and executed the first interactive commands within one second. The machine-optimized formatting of those commands, echo delimiters, bounded output captures, pager-disabled flags, was apparent from the first request.

Phase 2, Credential harvest (18:24:14 UTC). The LLM agent enumerated /app/.env files, /etc/environment, /proc/*/environ, and ~/.aws/credentials. It extracted two sets of cloud credentials and a PostgreSQL password from ~/.pgpass.

Phase 3, AWS Secrets Manager pivot (19:26:31 UTC). Forty-eight minutes after initial compromise, the agent replayed the harvested AWS credentials across 11 distinct Cloudflare Workers egress IPs, issuing 12 secretsmanager:GetSecretValue API calls in 22 seconds to retrieve an ed25519 SSH private key.

Phase 4, SSH bastion and database exfiltration (19:30:30 to 19:32:23 UTC). Using the retrieved SSH key, the agent opened eight parallel SSH sessions from six Cloudflare Workers IPs, enumerated the PostgreSQL schema via pg_tables, and dumped all six tables in 113 seconds.

The complete timeline from initial WebSocket connection to finished database exfiltration ran 68 minutes and 39 seconds. No stage paused for human coordination.

At 18:23:44 UTC, the first connection arrived at the marimo /terminal/ws endpoint. Every command from the first second followed the same machine-optimized structure: echo '---' delimiters for output parsing, 2>&1 | head -N bounded captures to prevent output hangs, -P pager=off flags to disable interactive less, and quoted-EOF HEREDOCs bundling multiple queries into single execution units. This formatting appeared in every command across the entire session, across all IP addresses involved. A human operator does not maintain that consistency across hundreds of commands on multiple network paths simultaneously.

The 48-minute gap between credential harvest at 18:24:14 and the first AWS API call at 19:26:31 represents the agent's context-switching time, or a deliberate cooldown to reduce detection surface. During this gap, no commands executed on the compromised host.

The AWS pivot phase completed in 22 seconds. The agent issued 12 redundant secretsmanager:GetSecretValue calls across 11 separate Cloudflare Workers egress IPs. The redundancy is a behavioral AI signature: a human operator calls a secret once. The agent called it 12 times, each call from a different execution context within the agent framework, each independently retrieving the same value. The distribution across 11 IPs prevented any single IP from sending more than two requests, defeating threshold-based alerting at every point.

The final 113-second phase opened eight parallel SSH sessions from six distinct IPs, enumerated the internal database schema without any prior knowledge of its structure, and exfiltrated the full contents of six production tables. The agent located a credential table it had no advance knowledge of by running a live schema query and reasoning about which tables contained the highest-value data.

Sysdig identified four properties that distinguish LLM agent execution from both human-operated attacks and traditional scripted automation. These signatures are now detection targets for threat hunters.

Signature 1, Improvised target enumeration. The internal database hostname was opaque. No application identifier existed on disk and no schema dump was pre-staged. The agent discovered the credential table through live pg_tables enumeration and immediately targeted it. A scripted playbook cannot adapt to an unknown schema. A human operator could, but the command velocity across the session ruled out human-directed execution. The agent composed the exfiltration path live, based solely on what it found in the environment.

Signature 2, Planning comment leakage. Embedded in the command stream was the Chinese-language annotation "看还能做什么", "See what else we can do." This comment appeared across six distinct IP addresses at sub-second cadence. It leaked from the LLM agent's internal reasoning chain into its command output. Human operators do not annotate their actions in multi-IP command streams at sub-second velocity. The comment is a direct artifact of the agent's chain-of-thought generation appearing in the executed output.

Signature 3, Machine-optimized command structure. Every command in the session used identical formatting: echo '---' output delimiters, 2>&1 | head -N bounded captures, -P pager=off to disable interactive paging, and suppressed error streams. This consistency across hundreds of commands spanning multiple IP addresses and multiple attack phases indicates a single automated process generating all commands. Human operators format commands for readability. LLM agents format commands for machine output parsing.

Signature 4, Output-dependent handoffs. The agent fed each command's output directly into subsequent actions. The PGPASSWORD value came from ~/.pgpass content captured earlier. The SecretId for the AWS Secrets Manager call came from the ListSecrets response. Directory paths came from prior ls /home/ enumeration. This chaining, where each step depends on the actual result of the previous step rather than a hardcoded value, is the defining operational difference between a live AI agent and a pre-scripted tool.

Any organization running marimo notebook instances accessible from the public internet on versions 0.20.4 or earlier is exposed to initial access via CVE-2026-39987. The LLM agent post-exploitation risk extends to every host, credential store, and internal system reachable from that marimo instance.

Marimo is a reactive Python notebook platform widely used in data science, machine learning, and analytics workflows. Enterprise deployments frequently run marimo on cloud instances with access to production credentials, cloud APIs, and internal databases. The Sysdig incident demonstrates the exact risk: a development notebook environment connected to AWS Secrets Manager, an SSH bastion, and a production PostgreSQL database. An attacker who gains RCE on the notebook gains the same cloud access the notebook's host environment was granted.

The most exposed deployment pattern is a marimo instance running in a cloud environment where the host has IAM roles or stored credentials with access to other cloud services. The notebook is a development convenience. The AWS credentials it stores are production-grade. MLOps platforms, data pipeline orchestrators, and Jupyter-adjacent environments that follow similar deployment patterns face identical exposure.

The LLM agent post-exploitation pattern is not limited to marimo. Any application RCE that lands on a host with cloud credentials, secret stores, or internal network access is now subject to the same four-pivot chain: credential harvest, cloud API pivot, internal network access, data exfiltration. CVE-2026-39987 is the entry point in this specific incident. The capability to autonomously execute that chain exists wherever an attacker can deploy an LLM agent post-compromise.

For context on the broader AI-assisted attack escalation, including the first confirmed LLM-generated exploit code in the wild, see the AI-built zero-day that bypassed 2FA, documented by Google GTIG in May 2026. The marimo incident confirms that AI is no longer only in the exploit development phase: it is now operational in the post-compromise phase as well.

Detection of the Marimo CVE-2026-39987 compromise and LLM agent activity requires log sources covering the marimo application, AWS CloudTrail, SSH access logs, and database query logs.

Marimo endpoint detection. Any access to /terminal/ws from an unexpected source IP is an exploitation indicator. Restrict this endpoint to trusted network ranges via reverse proxy or firewall rules. Log all WebSocket connections to /terminal/ws with source IP, timestamp, and session duration.

AWS CloudTrail behavioral detection. The LLM agent's redundant API call pattern produces a distinctive CloudTrail signature: multiple secretsmanager:GetSecretValue calls for the same SecretId arriving within seconds from multiple source IPs in the 104.28.0.0/16 Cloudflare Workers range. Alert on: more than two GetSecretValue calls for the same SecretId within 60 seconds, GetSecretValue calls originating from Cloudflare Workers IP space (AS13335) rather than your cloud instance's expected IP, and sts:GetCallerIdentity calls that do not match expected service principals.

SSH behavioral detection. Eight parallel SSH sessions opened simultaneously from Cloudflare Workers IPs to an internal bastion is anomalous. Alert on: multiple simultaneous SSH connections to the same bastion from different source IPs within a 30-second window, SSH connections originating from Cloudflare Workers IPs (104.28.0.0/16) to internal hosts, and SSH session durations under 120 seconds with high command volume.

Database query detection. The agent's schema enumeration via pg_tables followed immediately by large SELECT queries across multiple tables is a database threat hunting signature. Alert on: SELECT tablename FROM pg_tables immediately followed by bulk SELECT from tables named credential, api_key, or user, and application-user PostgreSQL connections issuing pg_tables queries without prior application context.

LLM agent command signature. Hunt for the echo '---' delimiter pattern in SSH session logs and shell command audit logs. This pattern in command streams that span multiple source IPs at high velocity is a strong indicator of machine-generated command execution.

For a related supply chain attack pattern where AI tooling was used to generate malware variants that evaded signature detection on first deployment, see the SLOPOLY AI-generated malware and Hive0163 Interlock ransomware breakdown.

Update marimo to version 0.23.0 immediately. If running an internet-accessible instance on any version through 0.20.4, treat it as compromised pending investigation.

The Marimo CVE-2026-39987 incident marks a transition in the threat landscape: AI is no longer only accelerating exploit development. It is now operational in the post-compromise phase, autonomously executing multi-stage attack chains with adaptive decision-making at each step.

The key shift is the decision layer. Traditional scripted post-exploitation tools execute a fixed sequence of commands regardless of what they find. LLM agents observe the environment and reason about the next action. When the marimo agent found an opaque database hostname with no schema pre-staged, it did not fail and exit. It ran a live schema query, identified a credential table, and exfiltrated it. That adaptive behavior breaks the core assumption behind most current detection strategies: that post-exploitation follows predictable patterns.

This capability does not require nation-state resources. The tools to build an LLM-powered attack agent are commercially available. The AI APIs that would power this kind of autonomous post-compromise operation are accessible on the open market. The marimo incident involved an unknown attacker group, not a documented APT. The capability demonstrated here is available to any threat actor willing to invest the operational time to deploy it.

The organizational risk is concentrated in three areas. Development and research environments running notebook platforms with cloud credential access are the immediate exposure. MLOps pipelines and data science infrastructure that follow similar deployment patterns, notebook platform on a cloud host with API keys and secret store access, are the next tier. Any environment where an RCE vulnerability can land an attacker on a host connected to internal systems is now in scope for automated multi-pivot exfiltration without requiring a human operator to direct each step.

The three defenses that matter most are: removing internet exposure from any development tool that stores cloud credentials, implementing runtime detection for the LLM agent behavioral signatures Sysdig documented, and treating cloud credential rotation as a standard incident response step whenever any public-facing application is compromised. The marimo incident ended with a full internal database dump in 68 minutes. A defender who catches the /terminal/ws WebSocket connection in the first minute eliminates all four subsequent pivots.