Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit

Sysdig Threat Research reported that a threat actor exploited CVE-2026-39987, a pre-authentication remote code execution flaw in marimo’s `/terminal/ws` endpoint, to gain shell access to a notebook host and pivot into AWS infrastructure. Over a nine-hour session, the operator manually built and tested Python tools that harvested AWS credentials from host and Redis-backed application sources, retrieved an SSH key from AWS Secrets Manager, and used it to access a bastion host, completing the final WebSocket-to-SSH sequence in eight seconds. Unlike previously observed AI-assisted attackers targeting the same flaw, this operator showed no apparent LLM fingerprints, avoided a planted prompt-injection trap, and used hand-rolled scripts, although a failed EC2 Instance Connect attempt exposed an automation error involving a placeholder instance ID. The report emphasizes that defenders should detect the overall attack chain—credential access, Secrets Manager calls, outbound connections, and SSH pivots—rather than rely on distinctive shell-command patterns, while recommending upgrades to marimo 0.23.0 or later, restricted terminal exposure and egress, tighter IAM permissions, credential rotation, and investigation of suspicious temporary files and cloud activity.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.