A human operator broke into a cloud infrastructure in just eight seconds using a custom-built toolkit, matching speeds typically seen only in attacks driven by artificial intelligence, according to a technical analysis published September 11 by Sysdig's Threat Research Team. The attacker exploited a vulnerability in the Marimo notebook platform to move from initial access to a secure bastion host with no evidence of using large language models or AI assistance at any point. The finding challenges assumptions that ultra-fast attacks are the signature of automated threats.
The operator exploited CVE-2026-39987, a pre-authentication remote code execution vulnerability affecting Marimo versions up to and including 0.20.4, which has been fixed in version 0.23.0. The flaw existed in the terminal WebSocket endpoint, which failed to apply the authentication check used on the platform's other WebSocket endpoints, allowing any client who opened a connection to receive an interactive shell as the Marimo process user without providing credentials. Over a nine-hour session, the attacker logged more than 850 interactive commands and deployed no recognizable public offensive tools. The operator had spent roughly four hours in earlier sessions building and debugging the Python toolkit, storing eight scripts on the compromised host so a subsequent reconnection could execute the complete attack chain from a single command.
The report describes how the attacker harvested cloud credentials from two locations on the host: the process environment and the application's Redis backend, then replayed them against the AWS account. One credential set returned an SSH private key from AWS Secrets Manager, which the operator used to authenticate to an internet-accessible bastion host. Sysdig writes that this matters because Marimo notebooks typically run alongside machine learning pipelines on hosts containing GPU access, large datasets, and credentials for AWS, GCP, and model providers, making a compromised notebook "the door to the victim's cloud account." The operator bypassed a prompt injection trap Sysdig had planted specifically to catch LLM agents—a directive instructing any model reading a particular file to echo a hidden marker into its output. Every AI-driven operator profiled against this vulnerability echoed the marker, but this attacker inspected the same file twice and never echoed it, which Sysdig calls "its clearest non-LLM signature to date."
Sysdig explains that the critical lesson is that detection systems can't rely on the fingerprints of a single attacker type. An LLM-generated command stream and a hand-typed one appear completely different but arrive at the same Secrets Manager call, SSH key handoff, and bastion connection, meaning the priority should be the shape of the attack chain rather than the typing patterns. The report recommends updating to Marimo 0.23.0, placing the terminal endpoint behind authentication or disabling it entirely, scoping Secrets Manager permissions so a notebook's credentials can't read a bastion key, and rotating anything exposed on an accessible instance. CVE-2026-39987 has been listed on CISA's Known Exploited Vulnerabilities catalog for months, with a federal remediation deadline of May 7, 2026. Organizations relying on behavioral signatures that assume speed equals automation may find themselves blind to skilled human operators who've simply done their homework. The gap between threat modeling and threat reality is narrowing faster than many security teams have recognized.