Sysdig catches first live LLM attack on AWS database

Sysdig’s Threat Research Team reported what they describe as the first confirmed live attack using an LLM agent for autonomous post‑exploitation in a cloud environment.[13] Attackers exploited CVE‑2026‑39987 in Marimo notebooks to gain an initial foothold, then supplied stolen AWS credentials to an AI agent that automatically replayed credentials, retrieved SSH keys from AWS Secrets Manager, moved laterally via an SSH bastion, and fully exfiltrated a PostgreSQL database without human intervention.[13]

Sysdig Threat Research reported what it describes as the first confirmed live attack using an LLM agent for autonomous post-exploitation in a cloud environment. According to the report, attackers first exploited CVE-2026-39987 in Marimo notebooks, then used stolen AWS credentials to drive an AI agent that replayed credentials, retrieved SSH keys from AWS Secrets Manager, moved laterally through an SSH bastion, and exfiltrated a PostgreSQL database without human intervention. RealGround implication: this is a high-signal example of AI agent abuse in the wild, so controls should focus on agent permission boundaries, credential handling, tool-use auditing, and red-team validation of autonomous post-compromise behavior.