Human Attacker Matches AI Speed in Marimo RCE Breach
A skilled operator pivoted from a notebook vulnerability to an SSH bastion in eight seconds, bypassing traps that typically catch AI agents.
A high-skill threat actor recently exploited a critical vulnerability in Marimo notebooks to breach an SSH bastion host in just eight seconds. The incident demonstrates that elite human operators can now match the execution speed of automated AI attacks while maintaining superior stealth.
The attacker leveraged CVE-2026-39987, a pre-authenticated remote code execution (RCE) vulnerability affecting all versions of Marimo. The flaw carries a severe CVSS score of 9.3. According to analysis by the Sysdig Threat Research Team, the operator used a custom Python invocation to harvest AWS credentials and retrieve a private SSH key from AWS Secrets Manager, allowing them to authenticate to the bastion host in a single, rapid sequence.
The AI Discovery Era
This breach occurred within the context of what researchers call the "AI discovery era," a period characterized by a shrinking window between the public disclosure of a vulnerability and its active exploitation. As AI-driven tools make it easier to automate the discovery and weaponization of flaws, security teams have increasingly focused on detecting "Agentic Threat Actors" (ATAs)—AI agents that follow predictable, automated patterns to navigate a network.
Why Human Skill Still Wins
This specific attack is significant because it renders some AI-focused detection strategies insufficient. While the eight-second pivot is the kind of velocity typically associated with machine-led attacks, the operator demonstrated a level of adaptability that AI currently lacks. The Sysdig Threat Research Team noted that the attacker "walked straight past a trap" that every profiled AI agent had fallen into when targeting the same CVE.
By using a bespoke, hand-written toolkit rather than public offensive tools or predictable AI scripts, the attacker avoided the behavioral signatures that modern security platforms use to flag automated bots. This proves that the primary threat is not merely the automation of attacks, but the ability of skilled humans to build stealthy, custom tools that mimic machine speed without the accompanying machine predictability.
What to Watch
Organizations using Marimo notebooks should prioritize patching CVE-2026-39987 immediately to close the RCE vector. Beyond patching, the incident highlights a need for detection systems that look beyond the "speed" of an attack to identify the nuanced evasion techniques used by human operators. Security teams must now account for a hybrid threat landscape where the line between human intuition and machine execution has effectively vanished.