Why Attack Speed Is Becoming a Leadership Problem

Overview

A recent attack observed by Sysdig demonstrated just how quickly a skilled attacker can move once initial access has been achieved. Exploiting CVE-2026-39987, a critical pre-authentication remote code execution vulnerability in the Marimo Python notebook platform, the attacker moved from a compromised notebook to successful SSH authentication on a bastion host in just eight seconds. What makes the incident particularly interesting is that the attack was not driven by an AI agent. The operator developed and refined a custom Python toolkit manually and then used it to automate the credential-pivot chain. For IT leaders, the message is important: organisations are not only defending against AI-powered attackers. Skilled humans equipped with automation can operate at similar speeds.

How the Attack Unfolded

CVE-2026-39987 affects Marimo’s terminal WebSocket functionality. The vulnerable endpoint failed to correctly enforce authentication, allowing an unauthenticated attacker who could reach the service to obtain an interactive shell. The vulnerability affects versions prior to 0.23.0, where the authentication issue was corrected. Once inside the environment, the attacker harvested AWS credentials, accessed AWS Secrets Manager, retrieved an SSH private key and authenticated to a bastion host. During one observed sequence, the entire journey from opening the WebSocket connection to reaching the bastion took eight seconds.

The Real Risk Was the Credential Chain

The initial vulnerability provided access, but the wider compromise became possible because the affected workload had access to valuable cloud credentials. This highlights an important cloud-security principle: the impact of a compromised workload depends heavily on what that workload is allowed to access next. Notebook environments used for development, data science and AI can have connections to cloud services, datasets, model platforms, secrets and production resources. If those identities are overprivileged, compromising one application can quickly become a cloud-account or infrastructure compromise.

AI Is Not the Only Machine-Speed Threat

Much of today’s cybersecurity discussion focuses on AI-powered attacks, and that risk is real. Sysdig has previously observed AI agents exploiting the same Marimo vulnerability and moving through cloud environments autonomously. However, this incident demonstrates that experienced human operators can achieve similar speed once they have developed the necessary tooling. In fact, Sysdig observed that the human attacker avoided a defensive trap that had previously caught AI-driven attackers. This reinforces an important point: security teams should not build detection strategies around whether an attacker appears human or AI-driven. The priority should be detecting behaviour and attack paths.

What IT Leaders Should Consider

Organisations running Marimo should upgrade to version 0.23.0 or later and ensure notebook environments are not unnecessarily exposed to untrusted networks. More broadly, cloud credentials should follow least-privilege principles, secrets should be tightly scoped, and workloads should only have access to the resources they genuinely require. Security teams should also correlate runtime, identity and cloud activity. A suspicious WebSocket connection, unexpected Secrets Manager request and SSH authentication may appear unrelated when viewed separately, but together they form a clear attack path.

Expert in the Cloud Insight

The most important lesson from this incident is not that an attacker moved in eight seconds. It is that the environment allowed an initial application compromise to become a credential compromise and then an infrastructure pivot almost immediately. CIOs, IT managers and security leaders should therefore think beyond preventing the first breach. Modern security architecture must assume that initial access may eventually occur and ask: “If this workload is compromised, what can the attacker reach next?” AI will continue to increase attack speed and scale, but skilled attackers have demonstrated that they do not need AI to move quickly. The strongest defence is therefore not trying to outrun the attacker after compromise—it is designing the environment so that one compromised system cannot unlock the next.