Human Attacker Exploits Marimo RCE to Reach Cloud Bastion in Eight Seconds

A human attacker used a custom-built Python toolkit to exploit a remote code execution (RCE) vulnerability in the Marimo notebook platform, reaching an SSH bastion host in just eight seconds. While the speed of the final exploitation stage mirrored that of automated AI-driven agents, researchers confirmed the operator was a human who spent hours preparing the attack chain.

Technical details of the vulnerability

The exploit targeted CVE-2026-39987, a pre-authentication flaw affecting Marimo versions up to and including 0.20.4. The vulnerability resides in the platform’s terminal WebSocket endpoint, which failed to apply the authentication checks required by other endpoints. This allowed an attacker to establish a connection and receive an interactive shell with the privileges of the Marimo process without providing any credentials.

The attacker targeted cloud environments by harvesting credentials from the host’s process environment and the application’s Redis backend. These credentials were replayed against an AWS account, where the attacker accessed AWS Secrets Manager to retrieve an SSH private key for an internet-reachable bastion host. Sysdig researchers noted that while the final execution was rapid, the operator spent approximately four hours building and debugging a toolkit of eight scripts to facilitate the nine-hour session.

Bypassing AI detection

Sysdig’s Threat Research Team discovered the human element after an experimental trap failed to catch the operator. The researchers had placed a directive in a vulnerable container to instruct any Large Language Model (LLM) agent reading the file to echo a specific hidden marker. While every AI-driven agent profiled echoed the marker, the human attacker inspected the file twice and did not trigger the prompt injection.

This outcome suggests that detection strategies cannot rely solely on the signatures of AI-generated command streams, as human-typed commands can reach the same critical security endpoints.

Mitigation and remediation

The vulnerability is currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalogue. To secure environments, Sysdig recommends upgrading to Marimo version 0.23.0 or later. Organisations should also consider placing the terminal endpoint behind authentication, disabling it if not required, and restricting Secrets Manager permissions to prevent notebook credentials from accessing sensitive keys.