Threat actor used LLM agent to exfiltrate database after compromising marimo
A threat actor reportedly exploited CVE-2026-39987 in marimo Python notebooks to gain initial access, then used an LLM agent to conduct post-compromise activities including credential harvesting and database exfiltration. The attack completed in approximately one hour, with the LLM agent demonstrating autonomous decision-making throughout the intrusion chain.
What happened
An unknown threat actor exploited CVE-2026-39987, a critical pre-authenticated remote code execution vulnerability in marimo notebooks prior to version 0.23.0, to gain initial access to an internet-reachable marimo notebook.
The attacker extracted cloud credentials from the compromised host, replayed them through an egress pool to retrieve an SSH private key from AWS Secrets Manager, and used that key to conduct eight parallel SSH sessions against a downstream SSH bastion server to exfiltrate the schema and full contents of an internal PostgreSQL database in under two minutes.
Sysdig identified four indicators suggesting an LLM agent conducted the post-exploitation activity: improvised database dumps without prior schema knowledge, a Chinese-language planning comment in the command stream, commands designed for machine consumption with specific delimiters and output handling, and value handoffs extracted from prior tool output.
Reported impact
The attack resulted in exfiltration of an internal PostgreSQL database, including both schema and full contents.
The complete attack chain lasted approximately one hour from initial compromise through database exfiltration.
Index analysis
The LLM agent demonstrated autonomous decision-making capabilities, discovering an opaque database hostname with no application identifier on disk and locating a credential table within minutes despite having no pre-staged schema dump.
The attacker no longer requires visibility into the target environment to operate effectively within it, according to Sysdig's assessment.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.