A human attacker has moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a toolkit built by hand, hitting a speed usually associated with AI-driven attacks.
In a technical write-up published on September 11, Sysdig’s Threat Research Team said the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, and showed no sign of using a large language model (LLM) at any stage.
A Human at Machine Speed
CVE-2026-39987 affects Marimo up to and including 0.20.4 and is fixed in 0.23.0. The flaw is in the terminal WebSocket endpoint, which skipped the authentication check applied to the platform’s other WebSocket endpoints, so any client that opened a connection to it got an interactive shell as the Marimo process user with no credentials.
Sysdig said that matters because Marimo notebooks usually run alongside machine learning pipelines, on hosts holding GPU access, large datasets and credentials for AWS, GCP and model providers. A compromised notebook, it said, is the door to the victim’s cloud account.
The operator harvested cloud credentials from two surfaces on the host, the process environment and the application’s Redis backend, and replayed them against the AWS account. One returned an SSH private key from AWS Secrets Manager, used to authenticate to an internet-reachable bastion host.
The eight seconds was not the whole attack. Sysdig said the operator spent about four hours building and debugging the Python toolkit in earlier sessions, storing eight scripts on the host so a later reconnection fired the finished chain from one command.
Over a nine-hour session it logged more than 850 interactive commands and no recognizable public offensive tooling.
Read more on AI-driven attacks: Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits
The Attacker Bypassed a Trap Built for AI
Sysdig had planted a directive in the vulnerable container to catch LLM agents, telling any model that read a particular file to echo a hidden marker into its output. Every AI-driven operator profiled against this flaw echoed it.
This operator inspected the same file twice and never echoed it. That prompt injection trap, which reliably caught AI agents, did not catch a human, and Sysdig called the result its clearest non-LLM signature to date.
The takeaway, Sysdig said, is that detection cannot lean on the fingerprints of one attacker type. An LLM-generated command stream and a hand-typed one look completely different but end at the same Secrets Manager call, SSH key handoff and bastion connection. This means the priority is the shape of the chain, not the typing.
Sysdig’s recommendations include updating to 0.23.0, putting the terminal endpoint behind authentication or disabling it, scoping Secrets Manager permissions so a notebook’s credentials cannot read a bastion key, and rotating anything exposed on a reachable instance.
CVE-2026-39987 has been on CISA’s Known Exploited Vulnerabilities (KEV) catalog for months, with a federal remediation deadline of May 7, 2026.
