A hand-debugged Python toolkit turned marimo CVE-2026-39987 into bastion SSH in eight seconds

The eight seconds were a replay of work already finished. Sysdig's timeline puts the first interactive command, a TCP probe across the host's /24, and the first credentialed AWS API call nearly four hours apart, and Sysdig says that window is very likely when the operator built and debugged the tooling ^[9]. By the reconnection the scripts sat on disk, and the chain needed one command to fire ^[10]. Four hours of build against eight seconds of execution: preparation ran 1,800 times longer than the run ^[3].

Marimo notebooks tend to be deployed alongside ML pipelines, on hosts with GPU access, large datasets and credentialed connections to AWS, GCP and model providers, which is why Sysdig calls a compromised instance the door to the victim's cloud account ^[15].

Delivery was unremarkable. Each script arrived as `echo '<base64-blob>' | base64 -d > /tmp/<name>.py`, and eight unique ones went in over a 17-minute window ^[11]. That is one script about every two minutes ^[2]. Sysdig says the base64 wrap sidesteps shell-quoting problems with embedded multi-line Python ^[12]. The boto3 chain script had been written and debugged across multiple sessions before it was dropped, and Sysdig reports no evidence of AI use in that process ^[13].

Every earlier marimo intrusion Sysdig profiled looked different. Those operators typed AWS request-signing code out from memory, line by line, in a single shell session ^[14]. This operator ran more than 850 interactive commands across the nine-hour session and used no recognisable publicly available offensive tooling ^[8]. That works out at about 94 commands an hour, one every 38 seconds, sustained for nine hours on a notebook host ^[1]. The eight-second pivot gives a detection engine almost nothing to match on. The four hours that produced it were 850 commands of shell noise.

The post opens with a claim its case study does not test. "AI is lowering the barrier to entry for attackers; that much is settled," the Sysdig Threat Research Team wrote ^[16]. The evidence here is one operator in one vendor's telemetry, and the comparison set is Sysdig's own profiles of agentic actors against the same CVE, whose speeds the post does not quantify ^[18]. That series began with exploitation less than 10 hours after disclosure of CVE-2026-39987 and continued with the NKAbuse RAT campaign ^[17].