Marimo RCE Exploited: Human Attacker Reaches SSH Bastion in 8 Seconds

A new report from Sysdig's Threat Research Team reveals that skilled human attackers can match machine-speed exploitation without any AI assistance. In one documented attack chain, a human operator exploited CVE-2026-39987—a pre-authenticated remote code execution (RCE) vulnerability in Marimo notebooks carrying a CVSS score of 9.3—and pivoted to an SSH bastion host in just eight seconds. According to Sysdig, "Eight seconds is the kind of speed we expect to see in AI-assisted attacks... This operator got there on skill alone," highlighting that expert tradecraft can outpace even well-engineered agentic frameworks.

The attack began at 12:52 p.m. with a WebSocket connection from IP address 172.236.12[.]17 to Marimo's exposed "/terminal/ws" endpoint, which is present in all vulnerable versions of the notebook platform. Within minutes, the threat actor leveraged the flaw to obtain a full interactive shell, then queried AWS Secrets Manager using credentials harvested directly from the compromised instance. The retrieved private SSH key was used to authenticate against the bastion host by 18:57:30—just eight seconds after the initial credential lookup at 18:57:22. Security teams investigating suspicious infrastructure can trace attacker origins with our WHOIS lookup tool, while organizations worried about exposed credentials should run an email breach checker to identify compromised accounts.

Over a nine-hour session, the operator issued more than 850 interactive commands using custom Python scripts written and debugged by hand in-session—no public offensive tooling or agentic frameworks were detected. The attacker deployed an asyncssh-style listener against an attacker-controlled VPS and consolidated the entire pivot into a single backgrounded Python3 invocation that pulled the harvested credential, fetched the SSH key from Secrets Manager, and authenticated to the bastion over SSH in one shot. Sysdig noted the human operator also evaded a detection trap that every AI agent they profiled against the same CVE had fallen into.

The findings arrive alongside Hunt.io's disclosure of a separate cryptomining campaign that compromised 3,562 Redis servers following broad internet sweeps on port 6379, running three parallel discovery pipelines including WordPress target enumeration. Network defenders can audit exposed services across their perimeter using our port scanner to identify risky open ports. Together, these reports reinforce that defenders must prepare for both AI-accelerated and expert human-driven intrusions, with strong credential hygiene, network segmentation, and continuous exposure monitoring remaining essential controls against modern cloud-native attacks.