Sysdig Documents First-Ever LLM Agent Cyberattack: Database Exfiltrated in Under an Hour

Key Takeaways

→ First confirmed AI-agent-driven intrusion captured by Sysdig's Threat Research Team, observed May 10, 2026

→ Entry point was CVE-2026-39987, a critical pre-auth RCE in Marimo's /terminal/ws WebSocket endpoint

→ Full chain from Marimo compromise to internal Postgres database dump ran end-to-end in under one hour

→ The SSH bastion phase exfiltrated schema and full database contents in less than two minutes

→ 12 AWS API calls fanned across eleven distinct Cloudflare Workers IPs in 22 seconds to defeat source-IP detection

Security researchers have documented the first confirmed cyberattack driven entirely by an LLM agent - and it moves from initial access to full database exfiltration in under an hour. The Sysdig Threat Research Team (TRT) observed the intrusion on May 10, 2026, recording an AI agent autonomously driving the post-compromise phase of a real-world attack.

Anatomy of the Attack

The chain began with an internet-reachable Marimo notebook - the open-source reactive Python notebook popular for data science and AI workflows. The attacker exploited CVE-2026-39987, a critical pre-authentication remote code execution flaw in Marimo’s /terminal/ws WebSocket endpoint, gaining a full interactive shell. What followed, Sysdig says, bears the behavioral signatures of an LLM agent operating as an autonomous operator rather than a human at a keyboard or a static script.

Four Pivots, Under an Hour

The agent ran the entire engagement in four pivots over roughly one hour:

Access - an unauthenticated WebSocket connection and immediate shell commands
Credential harvest - a systematic sweep of environment files, AWS credential stores, and SSH keys yielding two cloud credentials
AWS pivot - 12 GetSecretValue calls in 22 seconds, fanned across 11 distinct Cloudflare Workers IPs to defeat source-IP detection, retrieving an SSH private key
Database exfiltration - eight parallel SSH sessions dumped the schema and full contents of an internal PostgreSQL database in under two minutes

The Agent’s Fingerprints

Sysdig identified four signatures that distinguish this intrusion from scripted automation. First, the agent improvised a database dump against an unidentified target, inferring a credential table name that exists in no standard schema. Second, a Chinese-language planning comment - “See what else we can do” - leaked into the command stream mid-attack. Third, every command used machine-optimized formatting: delimiter injection, bounded output, stderr suppression, and HEREDOC batching. Fourth, and most diagnostically, the agent chained outputs from its own prior commands into the next call - lifting the database password from .pgpass and the SecretId from a ListSecrets response.

What This Means for Defenders

The defender-relevant property of an agent-in-the-loop is adaptiveness: a scripted attacker aborts on surprises, while an agent reads the surprise and keeps going. Sysdig’s guidance is blunt - patch Marimo to 0.23.0 or later, rotate any AWS credentials reachable from a Marimo process, and assume an internet-reachable Marimo with credentials on disk is a one-hour pivot device for an agent. This first confirmed case validates that LLM agents can compress post-exploitation from a skill-intensive manual activity into an inference-budget problem, shifting operational complexity from human expertise to compute cost.

Frequently Asked Questions

What was the first LLM agent cyberattack?

Sysdig documented an intrusion where an LLM agent drove the post-exploitation phase after a Marimo compromise via CVE-2026-39987, exfiltrating an internal PostgreSQL database in under an hour. It is the first confirmed AI-agent-driven intrusion captured by the company's Threat Research Team.

How did the LLM agent attack work?

The agent exploited a critical flaw in Marimo to gain shell access, harvested cloud credentials, retrieved an SSH private key from AWS Secrets Manager through a fanned-out egress pool, and dumped an internal database through parallel SSH sessions in four pivots lasting about an hour.

Why do researchers believe an LLM agent was behind the attack?

Four signatures point to real-time AI composition: improvised schema discovery with no prior intelligence, a Chinese-language planning comment leaking into the command stream, machine-readability formatting, and the agent feeding its own prior tool output into the next command.

How can organizations defend against LLM agent attacks?

Patch Marimo to 0.23.0 or later, rotate any AWS credentials reachable from Marimo processes, and deploy runtime behavioral monitoring tuned to catch machine-speed, output-chained command sequences that no human operator would produce.