DigitalSpying Security Desk
September 15, 2026
Executive Summary
In an era where security discourse is dominated by automated agentic artificial intelligence (AI) and autonomous offensive bots, a startling real-world intrusion captured by cloud security firm Sysdig and reported by The Hacker News demonstrates that elite human attackers still possess distinct tactical advantages over autonomous AI agents. Exploiting CVE-2026-39987 (CVSS 9.3)—a pre-authentication remote code execution (RCE) flaw in Marimo, the open-source reactive Python notebook widely used in data science and machine learning pipelines—a skilled human operator moved from initial WebSocket access to full root SSH authentication on an internal cloud bastion host in just eight seconds. Operating without AI assistance or public offensive frameworks, the intruder utilized a single, hand-crafted Python script executed in-session that bypassed the honeypot detection tripwires that tripped up every automated AI agent profiling the same flaw, illustrating the persistence of human-driven stealth and machine-speed agility.
Deep-Dive Technical Analysis
1. Root Cause Analysis: The Marimo Terminal WebSocket Flaw (CVE-2026-39987)
* Vulnerability Classification: Missing Authentication for Critical Function / Remote Code Execution (CWE-306, CVSS 9.3).
* Target Technology: Marimo is a reactive, pure-Python notebook framework engineered as an alternative to Jupyter. It integrates directly into developer workflows, Python data science pipelines, and containerized ML environments.
* The Core Architectural Flaw: Marimo exposes an internal interactive terminal session via a WebSocket endpoint at /terminal/ws. In vulnerable versions prior to 0.8.x, the WebSocket handshake fails to enforce authentication or cross-site WebSocket hijacking (CSWSH) validations.
* The Initial Exploit Primitive: An unauthenticated remote attacker who reaches an exposed Marimo port (default 2718) initiates a raw WebSocket upgrade to /terminal/ws. Once the socket connects, the endpoint spawns a full PTY shell running with the privileges of the underlying user hosting the notebook process, granting unrestricted interactive shell execution without entering passwords or API tokens.
2. The 8-Second Credential-Pivot Timeline
Sysdig’s forensic telemetry captured the exact chronological progression of the exploit sequence, highlighting machine-speed human execution:
Timestamp (UTC)
Elapsed
Attacker Operation / Network Action
Underlying Mechanism
18:57:22
0s
WebSocket Connection Initiated
Threat actor connects from 172.236.12[.]17 to /terminal/ws, establishing pre-auth PTY shell.
18:57:26
+4s
AWS IAM Key Harvested
Stored application configuration and environment variables parsed to extract active AWS IAM credentials.
18:57:30
+8s
AWS Secrets Manager Query & SSH Bastion Auth
Single backgrounded Python script queries AWS Secrets Manager, downloads bastion private SSH key, writes to /dev/shm, and authenticates to internal SSH bastion host.
THE 8-SECOND CREDENTIAL PIVOT CHAIN
[Human Operator (Originating from 172.236.12[.]17)]
1. Sends HTTP Upgrade -> ws://target:2718/terminal/ws (CVE-2026-39987)
[Vulnerable Marimo Python Notebook Instance]
* Pre-Auth WebSocket Terminal Accepts Connection
* Spawns Interactive PTY Shell Under Host User Context
2. Hand-Crafted In-Memory Python Routine Executes:
* Scans Environment & Memory for AWS IAM Credential Cache
[AWS Cloud Control Plane (Secrets Manager)]
3. Authenticates using Stolen AWS IAM Token
4. Fetches Production SSH Private Key for Corporate Bastion
[Internal Corporate SSH Bastion Host]
5. Injects Key to /dev/shm & Initiates Outbound SSH Handshake
* Complete Network Foothold Established (Total Time: 8 Seconds)
* Deploys AsyncSSH Reverse Listener to Attacker VPS
* 850+ Interactive Commands Executed Over 9-Hour Dwell Time
3. Human Tradecraft vs. Agentic AI: The Honeypot Divergence
A critical finding from Sysdig's research was the distinct behavioral difference between automated agentic threat actors (ATAs) and the human operator:
* How AI Agents Failed: When testing agentic LLM-driven exploit bots against honeypots simulating the same Marimo vulnerability, every AI agent predictably fell into basic canary traps. The AI agents ran generic reconnaissance commands (uname -a, id, whoami, checking fake canary directories) that triggered immediate honeypot tripwires and alerted defensive security orchestration tools.
* Human Evasion & Tailored Tooling: The human operator bypassed every canary trap. They issued zero generic reconnaissance commands during the initial breakout.
* Hand-Rolled Toolkit: Over a nine-hour session involving more than 850 interactive commands, the operator used no public offensive toolkits (no Metasploit, no Cobalt Strike, no Havoc, no LinPEAS). Everything was authored and debugged in real-time as modular Python 3 scripts, establishing custom AsyncSSH listeners back to their external VPS.
Industry Impact & Data Science Infrastructure Risks
* The Shadow Risk of ML/Data Science Notebooks: Tools like Marimo, Jupyter, and Streamlit are often spun up informally by data scientists, researchers, and developers without central IT oversight. Because they require access to internal training databases, production S3 buckets, and GPU compute clusters, they routinely hold excessive cloud IAM permissions.
* The Illusion of Defensive Reaction Windows: Incident response playbooks that assume human adversaries take hours or days to pivot once inside are obsolete. Skilled operators armed with pre-tested custom scripts can bridge edge applications to core infrastructure in seconds.
Actionable Recommendations & Hardening Playbook
1. Upgrade Marimo & Enforce Authentication
* Ensure all Marimo deployments are upgraded to version 0.8.0 or later, where WebSocket terminal connections require strict authentication and origin verification.
* When running Marimo in development or shared environments, launch with token authentication enabled: marimo edit --token and never expose ports without authentication.
2. Network Isolation for Data Science Workloads
* Bind Strictly to Localhost: Prevent notebook servers from binding to 0.0.0.0. Restrict access to 127.0.0.1 and enforce access via authenticated reverse proxies (e.g., OAuth2-Proxy) or private VPNs.
* Enforce Egress Filtering on Bastion & Compute Hosts: Restrict outbound network connections from notebook environments, blocking connections to unexpected cloud endpoints or foreign IP spaces.
3. Least Privilege for Cloud IAM Roles
* Constrain Secrets Manager Access: Never assign broad secretsmanager:GetSecretValue permissions to development workloads. Enforce resource-based policies that restrict IAM roles attached to notebook instances to specific, necessary application secrets.
* Monitor Terminal-Spawning Processes: Deploy behavioral cloud workload protection agents (such as Falco or Sysdig Secure) to alert when Python processes spawn interactive PTY shells or unexpected outbound SSH client connections.
Sources and Reference Intelligence: Sysdig Threat Research, The Hacker News, Marimo Open Source Project.