This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A threat actor exploited a vulnerability in a marimo Python notebook to gain initial access, then deployed an LLM agent to perform post-exploitation activities. The agent autonomously harvested AWS credentials, retrieved an SSH key from AWS Secrets Manager, and exfiltrated the schema and contents of an internal PostgreSQL database. Researchers identified the use of an AI agent based on the improvised nature of the database dump, the presence of planning comments in the command stream, machine-optimized command formatting, and the agent's ability to dynamically consume its own tool output.
An unidentified attacker reportedly used an LLM agent during a May 10 intrusion after exploiting a vulnerable marimo Python notebook. The agent reportedly reused harvested AWS credentials to obtain an SSH key, then pivoted through a bastion host and exfiltrated the schema and contents of an internal PostgreSQL database. Sysdig attributed the post-compromise command stream to real-time agent execution rather than a prebuilt script.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The LLM agent successfully exfiltrated the schema and full contents of an internal PostgreSQL database containing credentials.
The incident involved the use of an LLM agent to conduct a sophisticated cyberattack, executing post-compromise actions and exfiltrating database contents.
AI system
Due to a decision or action made by an AI system
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The cyberattack was executed by an LLM agent deployed intentionally by a threat actor to perform post-compromise actions in real time.
An unidentified threat actor exploited a vulnerability to deploy an autonomous LLM agent for post-exploitation and database exfiltration. While the direct national security impact is minor due to the target being an unnamed organization, the incident represents a highly novel, first-of-its-kind demonstration of autonomous AI-driven cyber espionage capabilities.
The report describes the AI system as an 'LLM agent' executing post-compromise actions in real time. It exhibited goal-directed behavior, planning, and adaptiveness, such as improvising a database dump and dynamically consuming its own prior tool outputs (e.g., lifting a password from .pgpass to use in subsequent psql commands).
Limited Risk: The system is a large language model (LLM) agent, which falls under general-purpose AI or chatbot-like systems requiring transparency, though here it was repurposed maliciously.
The LLM agent was used to dynamically generate and execute system commands (bash, SQL) to navigate the compromised environment and exfiltrate data.
The reports from Sysdig provide highly detailed technical evidence of the intrusion, including specific command logs, timestamps, and architectural details of the LLM agent's execution. The identification of the AI agent is well-supported by multiple behavioral signatures.
One could argue the attack was a highly sophisticated, pre-scripted human attack, but the sub-second multi-IP execution combined with Chinese planning comments and machine-optimized formatting strongly points to an LLM agent.
Technology
Vulnerable Marimo Notebooks
RCE vulnerability CVE-[PHONE_001] allowed initial access to the system.
LLM Agent Adaptability
LLM agent composed real-time command chains instead of rigid static scripts.
Evasion via Egress Pools
Cloudflare Workers bypassed source-IP correlation detection mechanisms.
Data Inputs
Exposed Cloud Credentials
AWS credentials stored in environment files on the compromised host.
Tool Output Consumption
LLM agent read and parsed previous tool outputs to execute next steps.
Opaque Database Hostname
Database lacked identifiers, forcing agent to guess schema based on priors.
Human Factors
Failure to Patch Vulnerability
Operators failed to update Marimo to version 0.23.0 to block RCE.
Leaked Agent Planning Comment
Internal Chinese planning comment leaked directly into the command stream.
Process and Methods
Inadequate Credential Rotation
Failed to rotate AWS keys and SSH keys exposed on compromised hosts.
Signature-Based Detection Failure
Traditional IP and command-sequence signatures failed against adaptive agent.
Lack of Telemetry and Monitoring
Lack of real-time monitoring allowed the attack chain to run in under an hour.
Management
Inadequate Asset Visibility
Management failed to ensure visibility across internal and external assets.
Lack of Runtime Threat Detection
Failure to deploy runtime threat detection across the network.
Regulatory Environment
Missed Federal Patch Deadlines
Federal due date for patching CVE-[PHONE_001] on CISA KEV catalog was missed.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
