In a startling development in cybersecurity, a human hacker has demonstrated the ability to exploit a vulnerability in the Marimo notebook platform, transitioning from a compromised notebook to an SSH bastion host in a mere eight seconds. This remarkable feat challenges preconceived notions about the speed of human attackers, often associated with AI-driven methodologies. The findings were detailed in a technical write-up released by Sysdig’s Threat Research Team on September 11.
The vulnerability in question, identified as CVE-2026-39987, allows for pre-authentication remote code execution and affects all versions of Marimo up to and including 0.20.4. The flaw resides within the terminal WebSocket endpoint, which uniquely lacks the authentication checks present in other WebSocket endpoints of the platform. This oversight enables any client that establishes a connection to gain interactive shell access as the Marimo process user, all without the need for credentials.
The implications of this vulnerability are significant, particularly given that Marimo notebooks are often deployed in environments supporting machine learning pipelines. These environments operate on hosts equipped with GPU access, hold large datasets, and contain sensitive credentials for cloud providers such as AWS and GCP. Consequently, gaining access to a compromised notebook can effectively serve as a gateway into the victim’s cloud accounts, escalating the severity of the threat posed by this attack.
During the breach, the operator successfully harvested cloud credentials from two sources on the host: the process environment and the Redis backend associated with the application. These credentials were subsequently replayed against the AWS account, yielding a critical SSH private key stored in AWS Secrets Manager. This key facilitated authentication to an internet-accessible bastion host, marking a significant escalation in the attack’s progression.
However, the eight-second window reported for the initial transition does not account for the entirety of the attack operation. Sysdig elaborated that the hacker had spent approximately four hours in previous sessions constructing and debugging a bespoke Python toolkit, ultimately saving eight distinct scripts on the host. This strategic preparation meant that when the operator reconnected, a single command could trigger the complete operation seamlessly.
Throughout a nine-hour engagement, the operator logged over 850 interactive commands without employing any recognizable public offensive tools. This level of ingenuity and customization underscores a sophisticated understanding of the attack vector and the environment.
An intriguing aspect of this incident lies in the bot detection measures implemented by Sysdig. The team had previously embedded a directive within the vulnerable container designed to intercept large language model (LLM) agents. This directive required any AI model that accessed a specific file to return a hidden marker in its output. Notably, every AI-driven operator previously profiled against this vulnerability echoed this marker; however, this particular human operator inspected the same file twice without mimicking that behavior. This lack of response led Sysdig to designate this anomaly as its most distinct non-LLM signature to date, reinforcing the notion that human and AI-driven tactics can exhibit dramatically different characteristics while leading to similar endpoints.
From this incident, Sysdig offered critical takeaways regarding detection methodologies. The findings suggest that cybersecurity strategies cannot rely solely on the signatures of one type of attacker. As illustrated by this attack, while an LLM-generated command stream and a manually typed one may visually differ, they ultimately converge at the same critical points—like accessing the Secrets Manager and executing an SSH key handoff for bastion connection. Thus, the focus for cybersecurity defenses should shift toward the overall structure of the attack chain rather than merely the typing style of the commands used.
To mitigate the risks associated with CVE-2026-39987, Sysdig urged immediate action, including upgrading to version 0.23.0 of the Marimo notebook platform. Other recommended actions include placing the terminal endpoint behind authentication, restricting the permissions of the Secrets Manager so that a notebook’s credentials do not have access to a bastion key, and regularly rotating any credentials exposed on public instances.
Furthermore, it is pertinent to note that CVE-2026-39987 has been listed in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog for several months. Organizations are urged to address this vulnerability before the federal remediation deadline on May 7, 2026. As cyber threats evolve, maintaining a proactive and well-informed posture against vulnerabilities is imperative for organizational resilience.