Sysdig Captures First In-the-Wild LLM Agent Post-Exploitation, marimo CVE to Internal Database Dump in Under One Hour

Sysdig TRT documented the first confirmed LLM-agent-driven intrusion: attacker used CVE-2026-39987 in marimo to reach AWS credentials and dump an internal PostgreSQL database in under 60 minutes.

Attacker-controlled LLM Agent / marimoCredential exposureLLM-agent-driven lateral movement / credential pivot / database exfiltrationmarimo notebook server / AWS Secrets Manager / SSH bastion / internal PostgreSQL database

What happened

Attacker exploited CVE-2026-39987 in marimo to harvest cloud credentials, used an LLM agent to replay credentials through a Cloudflare Workers egress pool to retrieve an SSH key from AWS Secrets Manager, then drove 8 parallel SSH sessions against a downstream bastion to dump an internal PostgreSQL database.

Why it matters

Full schema and contents of internal PostgreSQL database exfiltrated in under two minutes during the bastion phase. Tables dumped included api_key, credential, user, variable, flow, and message. The attacker's LLM inferred the schema shape from contextual signals without prior knowledge of the target database.

Missing authorization check

Not applicable: the agent was operated by the attacker, outside any boundary the victim controls.

Would PP block it?

No authorization boundary inside the victim's environment sits between this agent and its operator, because the operator is the adversary. Permission Protocol constrains agents acting under an organization's own authority.

Incident analysis

Timeline and technical read

Timeline

2026-05-10
18:23 UTC — Attacker opens first WebSocket to vulnerable marimo instance; interactive command (id) fired one second later
2026-05-10
18:24 UTC — Credential harvest begins: /app/.env, /etc/environment, ~/.aws/credentials enumerated
2026-05-10
19:26 UTC — First AWS API call (sts:GetCallerIdentity) using harvested key; 12 secretsmanager:GetSecretValue calls fanned across 11 Cloudflare Worker IPs in 22 seconds
2026-05-10
19:30 UTC — First SSH authentication on bastion using retrieved key
2026-05-10
19:30–19:32 UTC — Eight parallel SSH sessions dump host config and full PostgreSQL database contents in under two minutes

Technical breakdown

CVE-2026-39987 provides RCE via the marimo notebook terminal WebSocket endpoint — same vector Sysdig profiled in prior campaigns, but first observed with LLM agent-driven post-exploitation.
LLM agent confirmed by four behavioral signatures: improvised PostgreSQL dump against an unidentified target; planning comment in Chinese leaking into the command stream; command shapes built for machine consumption; value handoffs lifted from prior tool output.
Cloudflare Workers used as a per-request egress pool: 12 AWS API calls fanned across 11 distinct IPs in 22 seconds, defeating source-IP correlation in AWS CloudTrail and on-premises log correlation.
Attacker's LLM inferred a 'langflow-shaped' database from hostname alone and included a credential table not present in any tagged langflow release — demonstrating LLM-augmented schema inference from minimal context.
Full kill chain — RCE to internal database dump — completed in under one hour, illustrating how LLM agents compress post-exploitation timelines from days to minutes.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at: Credential Gate: secretsmanager:GetSecretValue and any retrieval of SSH keys, database credentials, or API secrets would require a PP-signed receipt naming the authorized agent and permitted use.
Still needs: Initial RCE via CVE-2026-39987 in marimo — PP does not provide vulnerability or network-layer protection. Post-retrieval SSH session commands once the key is already in attacker hands.
Receipt required for: Retrieval of SSH private key from AWS Secrets Manager; access to .env files or cloud credential stores on a compromised host; any database credential access by non-human callers.

The agent in this incident was operated by the attacker, not by the victim. Permission Protocol secures internal agent boundaries, not external network perimeters.

Lessons for teams

Credential stores (AWS Secrets Manager, HashiCorp Vault, .env files) need authorization gates beyond authentication — valid credentials are not sufficient proof of permitted purpose.
LLM agents compress post-exploitation timelines to under one hour; patch windows and detection thresholds calibrated for human-speed attacks are no longer adequate.
Cloudflare Workers-based egress fan-out defeats per-source-IP rate limiting and log correlation; IP-based controls are ineffective against agent-driven lateral movement.
Planning comments in non-English languages embedded in command streams are a new behavioral IoC for LLM-agent-driven intrusions.
LLM agents can infer database schemas from contextual signals without prior knowledge — internal schema 'obscurity' is no longer a mitigating factor.

Related incidents and controls

Critical2026-05-04

Braintrust AWS breach exposes org-level AI provider API keys for all customers: OpenAI, Anthropic, Google credentials at risk

High2026-05-21

Composio Breached via LLM-Generated Attack Patterns: Agentic Monitoring Tool Pivoted to Automated Remediation Systems

AI agent compliance controls Signed audit evidence

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop