Marimo CVE-2026-39987: Human Attacker Matches AI Speed in 8-Second Bastion Pivot

As reported by The Hacker News, Sysdig's Threat Research Team has documented a case that should recalibrate how defenders think about attacker speed. A skilled human operator exploited CVE-2026-39987 — a pre-authenticated remote code execution flaw in Marimo notebooks — and pivoted from initial foothold to SSH bastion authentication in eight seconds. No AI agent. No automation framework. Just tradecraft.

The conventional wisdom has been that AI-assisted attacks represent the new speed benchmark. This incident challenges that assumption directly. The attacker hand-wrote a Python script in-session, harvested AWS credentials from the compromised instance, retrieved an SSH private key from AWS Secrets Manager, and authenticated to a bastion host — all in a single chained operation. Over a nine-hour session, they issued 850+ interactive commands using no recognizable public tooling. This is what a competent human looks like when they know exactly what they're doing.

Vulnerability Details

Field	Details
CVE	CVE-2026-39987
CVSS	9.3 (Critical)
Type	Pre-authenticated Remote Code Execution
Affected Product	Marimo (all versions prior to patch)
Exploitation	Active in the wild within hours of disclosure
Patch Status	Vendor advisory available — update immediately

Why This Matters Beyond the CVE

The vulnerability itself is straightforward: a pre-auth RCE on an exposed WebSocket endpoint (/terminal/ws) in Marimo notebooks. What makes this case instructive is the post-exploitation sequence and what it reveals about defensive gaps.

The entire credential pivot — Marimo shell to AWS Secrets Manager to SSH key to bastion authentication — completed in eight seconds. Detection systems that rely on human response times or multi-stage alerting workflows are structurally incapable of intervening.

Three factors amplified the impact:

Why This Matters Beyond the CVE

Credential proximity: The Marimo instance had direct access to AWS Secrets Manager credentials, meaning one compromise cascaded immediately into cloud infrastructure access. No segmentation existed between the notebook tier and the bastion tier.

Tooling invisibility: The attacker used no public offensive tools. Custom Python scripts executed in-session generate no signature matches. Traditional EDR and threat detection that relies on known-bad binaries or IOCs would have seen nothing.

Speed asymmetry: Eight seconds from RCE to bastion authentication means there is no realistic window for manual intervention. Automated containment is the only viable response.

Who Is Most at Risk

Any organization running Marimo notebooks with internet-exposed WebSocket endpoints — particularly in cloud environments where the notebook instance has IAM permissions to access Secrets Manager or other credential stores. Data science and ML engineering teams that deploy notebooks in production or development cloud environments are the primary exposure surface. The pattern of embedding cloud credentials in notebook environments for convenience is exactly what makes this attack chain viable.

Shield53 Recommendations

Immediate Actions

Patch Marimo immediately. If you cannot patch, disable or restrict network access to the /terminal/ws WebSocket endpoint. Place Marimo behind an authenticated reverse proxy until updated.
Audit Marimo deployments. Inventory every instance across your environment. Check for internet-exposed notebooks that should be internal-only.
Segment credentials from notebook tiers. Remove IAM roles and Secrets Manager access from any notebook instance that does not strictly require it. Use short-lived, scoped tokens instead of persistent credentials.
Restrict SSH bastion access. Implement MFA on bastion hosts. Use SSH certificate-based authentication rather than static private keys. Apply network ACLs so only known IPs can reach bastion ports.
Deploy detection for the attack pattern. Monitor for: outbound calls from notebook processes to AWS Secrets Manager APIs, SSH key file writes to /tmp or ~/.ssh/, and new SSH sessions originating from notebook host IP addresses.
Hunt for indicators. Review logs for WebSocket connections from 172.236.12.0/24 or similar VPS-hosted IPs targeting Marimo endpoints. Check AWS CloudTrail for unexpected GetSecretValue calls originating from notebook instance identities.

Strategic Posture

This incident underscores that credential hygiene and network segmentation remain the highest-leverage controls. The attacker's speed was enabled not by sophistication of exploitation but by the structural convenience of the target environment: credentials were co-located with the compromise surface, and the bastion accepted a single-factor SSH key. Eliminating either condition would have broken the chain.

Defenders should also note that detection strategies built around identifying AI-assisted attack patterns may miss the more traditional threat: a skilled human who writes clean code, avoids traps, and adapts in real time. The real detection gap isn't AI vs human — it's the difference between reactive alerting and proactive environmental hardening.