Overview
A threat actor exploiting CVE-2026-39987, a pre-authenticated remote code execution (RCE) vulnerability in the Marimo interactive Python notebook platform (CVSS 9.3), was observed pivoting from initial WebSocket access to an SSH bastion host in just eight seconds. Documented by Sysdig’s Threat Research Team, the attack is notable not for AI involvement but for its deliberate absence — the operator used hand-written Python tooling, issued over 850 interactive commands across a nine-hour session, and evaded detection traps that uniformly caught every agentic threat actor (ATA) Sysdig had profiled against the same CVE.
The incident is directly relevant to AI security practitioners because Marimo is an AI/ML development environment, and the attack surface exploited — an unauthenticated WebSocket terminal endpoint — is architecturally common across notebook platforms used in data science and ML workflows.
Technical Analysis
The attack chain proceeded in three discrete stages following the initial WebSocket connection to /terminal/ws:
- Initial Access (18:57:22): A fresh WebSocket connection was established from
172.236.12[.]17, granting an interactive shell via CVE-2026-39987. - Credential Harvesting (18:57:26): The operator queried AWS Secrets Manager using credentials already present on the compromised Marimo instance, retrieving a private SSH key.
- Lateral Movement (18:57:30): SSH authentication was observed at the bastion host using the retrieved key — eight seconds after first connection.
The operator’s toolchain was a single backgrounded python3 invocation that pulled credentials, fetched the SSH key from Secrets Manager, wrote it to disk, and authenticated to the bastion in one shot. No publicly available offensive frameworks (e.g., Metasploit, Sliver) were used. Scripts were written and debugged in-session, which significantly reduced tooling-based detection signals.
Sysdig noted the attacker walked past a deliberate honeypot trap that every AI-driven attacker tested against the CVE had triggered — suggesting that human situational awareness and adaptive decision-making still outperform current agentic attack tooling in adversarial evasion contexts.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): The attack targeted Marimo, a product explicitly designed for AI/ML development, making the notebook environment the attack surface.
- AML.T0083 (Credentials from AI Agent Configuration): AWS credentials stored within the Marimo compute environment were harvested and used to pivot — analogous to credential theft from AI agent configuration stores.
- LLM06 (Sensitive Information Disclosure): Cloud credentials accessible to the notebook runtime were exfiltrated as part of the exploitation chain.
- LLM07 (Insecure Plugin Design): The exposed WebSocket terminal endpoint represents an insecure, unauthenticated interface within a development tooling context.
Impact Assessment
All versions of Marimo are affected. Organisations deploying Marimo in cloud environments — particularly where instance metadata or secrets are accessible from the notebook runtime — face risk of rapid credential theft and lateral movement. The eight-second pivot timeline leaves virtually no window for human-in-the-loop detection or response. The Hunt.io-disclosed Redis cryptomining campaign referenced in the same report signals broader opportunistic scanning activity that may overlap with Marimo targeting.
Mitigation & Recommendations
- Patch immediately: Apply vendor-issued patches for CVE-2026-39987; treat all previously exposed instances as compromised.
- Restrict WebSocket endpoints: Place Marimo notebook servers behind authentication proxies; do not expose
/terminal/wsto untrusted networks. - Least-privilege IAM: Ensure Marimo runtime environments hold only the minimum AWS permissions necessary; avoid storing SSH private keys or broad Secrets Manager access credentials in instance metadata or environment variables.
- Audit cloud logs: Review AWS CloudTrail and Secrets Manager access logs for anomalous credential lookups correlated with Marimo process activity.
- Deploy honeytokens: Sysdig’s findings confirm honeypot traps remain effective against agentic attackers; consider deploying fake credentials to detect exploitation attempts.