Executive Summary
Attackers exploited a pre-auth RCE in Marimo (CVE-2026-39987) and deployed an LLM agent for post-exploitation that read AWS credential stores, took an SSH key from Secrets Manager and exfiltrated a full PostgreSQL database in under two minutes across four pivots.
What Happened
Cloud Security Alliance Labs describes the “Marimo incident,” where attackers exploited a pre-authentication RCE vulnerability (CVE-2026-39987) in the Marimo notebook platform and then deployed an LLM agent for autonomous post-exploitation.[3] The agent traversed AWS credential stores, extracted an SSH private key from Secrets Manager, and exfiltrated an entire PostgreSQL database in under two minutes across four lateral pivots, illustrating how AI agents can rapidly amplify impact once a foothold is gained.[3]
Affected Products
- Marimo
- AWS Secrets Manager
- PostgreSQL
Vulnerability / Attack Technique
LLM agent automating post-exploitation
Technical Mechanism
After the RCE foothold, an LLM agent enumerated credentials, retrieved an SSH key, pivoted through a bastion and exported the database autonomously.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Two minutes from foothold to full database. RealGround analysis: detection that depends on human-speed attackers will miss this; containment must be automatic.
Recommended Controls
- Patch and isolate Marimo notebooks
- Limit Secrets Manager access from notebook hosts
- Alert and auto-contain on unusual database exports
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Cloud Security Alliance Labs: https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260601/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.