Critical Marimo RCE (CVE-2024-XXXX) Lets Attackers Access Internal Databases

Key Takeaways

• A critical Remote Code Execution (RCE) vulnerability, CVE-2026-39987, in marimo notebooks was exploited to gain initial access.
• The attack chain, observed by Sysdig, represents the first recorded instance of an intrusion driven by an AI agent (Large Language Model).
• The AI agent demonstrated adaptive, real-time command generation and distributed network activity, bypassing traditional security detections.
• The attack successfully exfiltrated an internal PostgreSQL database within one hour.
• Immediate patching to marimo version 0.23.0 or higher is crucial, alongside enhanced behavioral threat detection.

AI-Driven Attack Exploits Marimo RCE to Breach Internal Databases

In a significant evolution of cyberattack methodologies, security researchers have documented an intrusion where a Large Language Model (LLM) agent orchestrated a complex breach, moving from an exposed marimo notebook to the exfiltration of an internal PostgreSQL database in under an hour. This incident, captured by Sysdig’s Threat Research Team (TRT), marks the first observed AI-agent-driven cyberattack, signaling a new frontier in offensive cybersecurity.

The Attack Vector: Marimo RCE (CVE-2026-39987)

The initial compromise leveraged CVE-2026-39987, a critical remote code execution vulnerability present in unpatched marimo servers. This flaw enabled attackers to establish a shell with a single WebSocket request on an internet-exposed marimo notebook. Once inside, the threat actor swiftly moved to harvest cloud credentials from environment files and the AWS credentials store. These stolen credentials were then used to retrieve an SSH private key from AWS Secrets Manager.

With the SSH key in hand, the attackers initiated eight concurrent SSH sessions against a downstream bastion server. From this pivotal point, they successfully exfiltrated an entire internal PostgreSQL database. The entire attack chain, from initial compromise to data exfiltration, was completed in less than an hour, highlighting the speed and efficiency of the LLM-driven approach.

The Emergence of AI-Agent Driven Attacks

Sysdig’s TRT identified four key indicators suggesting the attack was powered by an LLM agent rather than a human operator or static script:

1. Improvised Database Exfiltration: The agent initiated a database dump without prior schema knowledge, intelligently enumerating tables and directly targeting a credential table that did not align with the application’s known schema. This demonstrated real-time reasoning based on general knowledge, not pre-configured instructions.
2. Internal Monologue in Command Stream: A Chinese-language planning comment, translating to “See what else we can do,” appeared directly within the command stream. This “internal monologue,” executed across six different IP addresses in sub-second intervals, is indicative of an automated thought process rather than human typing or a fixed script.
3. Machine-Optimized Commands: Every command was structured for machine parsing, incorporating structured separators, bounded output limits, and discarded error streams. This design allowed the agent to process each output cleanly and efficiently.
4. Dynamic Value Flow: The agent seamlessly integrated outputs from previous steps into subsequent actions. For example, a database password was used immediately after being read from a .pgpass file, and an SSH key path was confirmed before retrieval. An AWS secret ID was selected from a ListSecrets response merely 20 seconds before its retrieval, showcasing adaptive and autonomous operation.

Michael Clark, Sr. Director at Sysdig, emphasized the shift: “We are not watching AI replace attackers. We are watching attackers replace their scripts with AI.” This statement underscores the evolving nature of cyber threats, where AI agents enhance an attacker’s capabilities rather than replacing human ingenuity entirely.

Evasive Tactics and Detection Challenges

A notable aspect of this intrusion was the sophisticated method employed to evade detection. The attackers routed twelve AWS API calls across eleven distinct Cloudflare Workers IP addresses within a mere 22 seconds. This distributed approach effectively undermined traditional security mechanisms that rely on correlating activities from a single source IP. Similarly, during the bastion phase, eight SSH sessions originated simultaneously from six separate IP addresses, completely circumventing conventional IP-based alerting systems.

This distributed and adaptive behavior presents a significant challenge for legacy signature-based detection systems, which are designed to identify repeatable patterns. An LLM agent’s ability to dynamically alter its approach for each target renders static rules increasingly ineffective. Consequently, security defenses must pivot towards detecting the underlying malicious objectives—such as credential access or data exfiltration—rather than focusing solely on specific command sequences.

What You Should Do

• Patch Immediately: Update marimo instances to version 0.23.0 or later without delay.
• Restrict Access: If immediate patching is not feasible, restrict access to the /terminal/ws endpoint or disable the terminal feature entirely.
• Assume Compromise & Rotate Credentials: Treat any publicly accessible marimo instance as potentially compromised. Rotate all associated credentials, API keys, SSH keys, and database passwords.
• Enhance Telemetry and Behavioral Detection: Implement deep telemetry across your network and deploy runtime threat detection systems that can identify behavior-based patterns indicative of compromise, rather than relying solely on signature-based alerts.
• Monitor CISA KEV: Be aware that CVE-2026-39987 is listed on CISA’s Known Exploited Vulnerabilities catalog, and federal agencies have already passed their remediation deadline.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.