Attackers drive LLM agent for post-exploitation after Marimo CVE-2026-39987 RCE - AWS Secrets Manager to PostgreSQL exfil in minutes

Sysdig has documented a real-world intrusion in which a threat actor used an LLM agent to drive post-exploitation after compromising an internet-reachable Marimo notebook via CVE-2026-39987, a pre-authentication RCE affecting all Marimo versions up to 0.20.4 (fixed in 0.23.0). The attacker extracted two cloud credentials from the host, replayed them through a fanned-out egress pool to pull an SSH private key from AWS Secrets Manager, then used it to open eight short SSH sessions against a downstream bastion. The bastion phase exfiltrated the full schema and contents of an internal PostgreSQL database in under two minutes. The May 10 incident shows attackers operationalizing AI agents for hands-on-keyboard work.

Check

Inventory Marimo notebook deployments and confirm version is 0.23.0 or later. Check whether any are internet-reachable. Audit AWS Secrets Manager access logs and bastion SSH sessions since early May.

Affected

All Marimo versions up to and including 0.20.4 (pre-auth RCE, fixed in 0.23.0). Internet-reachable notebooks with access to cloud credentials and SSH keys are at highest risk.

Fix

Upgrade Marimo to 0.23.0+. Remove notebooks from public internet exposure. Rotate cloud credentials and SSH keys reachable from compromised hosts. Tighten Secrets Manager IAM scoping and add anomaly alerts.