Executive Summary
The Cloud Security Alliance reports the first confirmed intrusion driven end to end by an autonomous LLM agent: it exploited CVE-2026-39987 in a Marimo notebook, pivoted through AWS Secrets Manager and reached an internal PostgreSQL database in four automated steps.
What Happened
Cloud Security Alliance reports the first confirmed in‑the‑wild intrusion chain driven end‑to‑end by an autonomous LLM agent, where an attacker exploited CVE-2026-39987 in a Marimo notebook, pivoted through AWS Secrets Manager, and reached an internal PostgreSQL database in four automated steps.[18][27] The note describes how stolen or misconfigured AI compute and agent frameworks are being repurposed as offensive infrastructure, with the agent autonomously handling post‑exploitation tasks from initial access to data exfiltration.[18][28]
Affected Products
- Marimo
- AWS Secrets Manager
- PostgreSQL
Vulnerability / Attack Technique
Autonomous agent-driven intrusion chain (LLMjacking context)
Technical Mechanism
The agent exploited the notebook flaw, read secrets from AWS Secrets Manager, and used them to reach the internal database, handling post-exploitation itself.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Four automated steps from notebook to database. RealGround analysis: notebook hosts should not have broad secrets access, because an attacker or agent landing there inherits it.
Recommended Controls
- Patch Marimo and isolate notebooks
- Scope IAM roles on notebook hosts to the minimum secrets
- Alert on Secrets Manager reads from unusual hosts
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Cloud Security Alliance Labs: https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-offensive-ai-tooling-20260618-c/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.