Executive Summary
Sysdig reported the first confirmed live attack using an LLM agent for autonomous post-exploitation in the cloud: after exploiting CVE-2026-39987 in Marimo, attackers gave stolen AWS credentials to an agent that retrieved SSH keys, moved through a bastion and exfiltrated a PostgreSQL database.
What Happened
Sysdig’s Threat Research Team reported what they describe as the first confirmed live attack using an LLM agent for autonomous post‑exploitation in a cloud environment.[13] Attackers exploited CVE‑2026‑39987 in Marimo notebooks to gain an initial foothold, then supplied stolen AWS credentials to an AI agent that automatically replayed credentials, retrieved SSH keys from AWS Secrets Manager, moved laterally via an SSH bastion, and fully exfiltrated a PostgreSQL database without human intervention.[13]
Affected Products
- Marimo
- AWS Secrets Manager
- PostgreSQL
Vulnerability / Attack Technique
LLM agent automating cloud post-exploitation
Technical Mechanism
The agent replayed credentials, pulled SSH keys from Secrets Manager, pivoted via an SSH bastion and exported the database without human input.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
The human only needed the initial foothold. RealGround analysis: limit what any single foothold can reach, because agents will use all of it.
Recommended Controls
- Scope cloud credentials on notebook hosts tightly
- Alert on Secrets Manager reads and database exports
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
AIWeekly (reporting on Sysdig Threat Research): https://aiweekly.co/alerts/sysdig-catches-first-live-llm-attack-on-aws-database
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.