- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,366
From CVE-2026-39987 to PostgreSQL plumper per hour.
The attacker used an AI agent based on a large language model after hacking the publicly available Marimo server. According to Sysdig, the attack began with the operation of the CVE-2026-39987, and then moved to the fast chain of actions: collecting cloud accounts, contacting AWS Secrets Manager, obtaining a closed SSH key and connecting to an intermediate server through which there was access to an internal database.
Marimo is an environment for interactive computing notebooks. Vulnerability CVE-2026-39987 allows you to perform system commands before authentication. The error affects all versions of Marimo up to 0.20.4 inclusive, and the fix came out in version 0.23.0. After the publication of the patch, the vulnerability began to be used in real attacks: researchers have already seen manual exploration on baits and attempts to collect sensitive data.
The incident described by Sysdig took place on May 10, 2026. After accessing an open copy of Marimo, the attacker extracted two cloud-based secrets from the environment. He then used the received AWS key for queries to AWS Secrets Manager and took out the private SSH key.
After a few minutes, this key has already been used to enter the SSH-bastion. This is usually called an intermediate server through which administrators or services connect to closed internal systems. The attacker then opened eight short SSH sessions to the next server and uploaded the diagram along with the full content of the PostgreSQL internal base. The stage with the base took less than two minutes, and the entire chain of attack lasted a little more than an hour.
The main unusual part of the story is not in the very vulnerability of Marimo, but in behavior after burglary. Sysdig believes that further actions were performed by an AI agent, and not an ordinary pre-written script. The researchers identified four traits that point to automated work with elements of planning and adaptation.
The first sign is the way you work with a database. The attacker did not have a pre-prepared scheme, a clear name of the application on a disk or a ready-made plan for a particular environment. Despite this, the chain quickly led to the table with the account data. The agent did not know the system device in advance, but during the attack he analyzed the found clues and chose the next step.
The second sign is associated with a fragment of the planning, which accidentally hit the stream of commands. Sysdig discovered a Chinese phrase with the meaning of “see what else can be done.” It appeared while searching for the account and looked not part of the usual set of commands, but as a trace of reasoning or intermediate instructions that the agent should not have output.
The third feature is the format of the teams. They were arranged so that the result was conveniently treated by the machine: individual blocks were separated by a special marker, the output was limited in volume, the spreading turned off, and the flow of errors was discarded, so as not to add unnecessary noise. This style is more like a dialogue between tools than a person’s usual work in the terminal.
The fourth feature is the transmission of the found values from one step to another. For example, the agent first checked the desired file with the SSH key and then displayed its contents. Elsewhere, he used the data from the file with the connection parameters to PostgreSQL and substituted them into further actions. According to Sysdig, such a bundle indicates a system that reads its own previous output and builds the following request based on it.
For defenders, this scenario is unpleasant because the AI agent is not required to have a ready-made instruction for a specific network in advance. An ordinary script often breaks if it does not find the expected file, database diagram or work password. The agent may notice the discrepancy, pick up another path and continue the attack. In this mode, the limitation is not the writing of a separate set of commands for each goal, but the cost and time of the model.
Sysdig describes this attack as an example of a new practical problem. If an attacker gets initial access, an AI agent can quickly understand an unfamiliar environment, find useful secrets, go to the next system and collect data without long manual work. In this case, the path traveled from vulnerable Marimo to the internal PostgreSQL through cloud keys, AWS Secrets Manager and SSH-bastion.
Administrators are advised to update Marimo to the current version, check if there are publicly available copies of the service, and review all the surroundings where secrets could be stored. It is also worth replacing cloud account data, API keys and SSH keys, if there is a risk that they are on a compromised host. In such incidents, it is important to consider not only the server itself with a vulnerability, but also all the keys that the attacker could get after the first login.
The attacker used an AI agent based on a large language model after hacking the publicly available Marimo server. According to Sysdig, the attack began with the operation of the CVE-2026-39987, and then moved to the fast chain of actions: collecting cloud accounts, contacting AWS Secrets Manager, obtaining a closed SSH key and connecting to an intermediate server through which there was access to an internal database.
Marimo is an environment for interactive computing notebooks. Vulnerability CVE-2026-39987 allows you to perform system commands before authentication. The error affects all versions of Marimo up to 0.20.4 inclusive, and the fix came out in version 0.23.0. After the publication of the patch, the vulnerability began to be used in real attacks: researchers have already seen manual exploration on baits and attempts to collect sensitive data.
The incident described by Sysdig took place on May 10, 2026. After accessing an open copy of Marimo, the attacker extracted two cloud-based secrets from the environment. He then used the received AWS key for queries to AWS Secrets Manager and took out the private SSH key.
After a few minutes, this key has already been used to enter the SSH-bastion. This is usually called an intermediate server through which administrators or services connect to closed internal systems. The attacker then opened eight short SSH sessions to the next server and uploaded the diagram along with the full content of the PostgreSQL internal base. The stage with the base took less than two minutes, and the entire chain of attack lasted a little more than an hour.
The main unusual part of the story is not in the very vulnerability of Marimo, but in behavior after burglary. Sysdig believes that further actions were performed by an AI agent, and not an ordinary pre-written script. The researchers identified four traits that point to automated work with elements of planning and adaptation.
The first sign is the way you work with a database. The attacker did not have a pre-prepared scheme, a clear name of the application on a disk or a ready-made plan for a particular environment. Despite this, the chain quickly led to the table with the account data. The agent did not know the system device in advance, but during the attack he analyzed the found clues and chose the next step.
The second sign is associated with a fragment of the planning, which accidentally hit the stream of commands. Sysdig discovered a Chinese phrase with the meaning of “see what else can be done.” It appeared while searching for the account and looked not part of the usual set of commands, but as a trace of reasoning or intermediate instructions that the agent should not have output.
The third feature is the format of the teams. They were arranged so that the result was conveniently treated by the machine: individual blocks were separated by a special marker, the output was limited in volume, the spreading turned off, and the flow of errors was discarded, so as not to add unnecessary noise. This style is more like a dialogue between tools than a person’s usual work in the terminal.
The fourth feature is the transmission of the found values from one step to another. For example, the agent first checked the desired file with the SSH key and then displayed its contents. Elsewhere, he used the data from the file with the connection parameters to PostgreSQL and substituted them into further actions. According to Sysdig, such a bundle indicates a system that reads its own previous output and builds the following request based on it.
For defenders, this scenario is unpleasant because the AI agent is not required to have a ready-made instruction for a specific network in advance. An ordinary script often breaks if it does not find the expected file, database diagram or work password. The agent may notice the discrepancy, pick up another path and continue the attack. In this mode, the limitation is not the writing of a separate set of commands for each goal, but the cost and time of the model.
Sysdig describes this attack as an example of a new practical problem. If an attacker gets initial access, an AI agent can quickly understand an unfamiliar environment, find useful secrets, go to the next system and collect data without long manual work. In this case, the path traveled from vulnerable Marimo to the internal PostgreSQL through cloud keys, AWS Secrets Manager and SSH-bastion.
Administrators are advised to update Marimo to the current version, check if there are publicly available copies of the service, and review all the surroundings where secrets could be stored. It is also worth replacing cloud account data, API keys and SSH keys, if there is a risk that they are on a compromised host. In such incidents, it is important to consider not only the server itself with a vulnerability, but also all the keys that the attacker could get after the first login.
