Vulnerable dizziness and LLM agents who learn to attack in real time

An unknown actor has shown a new combination of tactics that should be concerned with cloud infrastructure and security equipment: the exploitation of a preauthenticated vulnerability in Marimo (CVE-2026-39987) followed by a post-commitment phase orchestrated by a Agent LLM which automates and adapts the intrusion in real time. According to the public analysis of the incident, the attacker took advantage of the remote execution of commands in Marimo to extract credentials from the committed machine, re-enter those credentials through an egress pool and call the AWS Secrets Manager API to recover a private SSH key. With that key it was authenticated against a bastion server and, in minutes, it opened multiple parallel SSH sessions to turn the scheme and full content of an internal PostgreSQL database.

The technical relevance is not only the vulnerability itself - which affects versions of Marimo prior to 0.23.0 and requires immediate parking - but the role of the LLM agent as adaptive operator. Unlike a static script that aborts when you find an unexpected scenario, an LLM agent interprets outputs, inverses the structure of the environment and links new actions based on its previous results. In this case the indicators include commands designed to be read by machines (with delimiters and coated catches), redirections to suppress noise and the automated reuse of previous outputs as input in subsequent steps. In other words, the adversary does not need a perfectly preadjusted template; his "engine" unfaithful and composes the chain of attack on the go.

The operational implications are profound: the entry barrier to exploit various objectives significantly reduces when the attacker has an agent who learns to run target-adapted generic playbooks. This multiplies the speed and scale of attacks, reduces the need for per-target engineering, and complicates detection because chained actions are more like a smart conversation than a noisy script. In addition, the use of cloud credentials to recover secrets and then authenticate internal connections exposes a classic vector that remains in place: excessive privileges and insufficiently segmented lateral motion horizons.

In the short term the most urgent measure is the patch: update any Marimo instance to the corrected version (or apply network compensation until you can update). It is also essential to audit public exposure of services, identify Internet-accessible bodies and take them off the public network if they are not strictly necessary. In addition, keys and credentials that may have been compromised should be rotated immediately and sessions and tokens should be revoked to allow side use.

To reduce the likelihood of re-exploitation and increase the possibility of detection, we need to combine prevention and detection controls: implement principle of less privilege in IAM, restrict access to Secrets Manager through VPC policies and link points, enable detailed logs and alerts in CloudTrail and in the service of secrets to detect GetSecretValue calls from unusual origins or in abnormal bursts, and limit the ability of hosts to perform indiscriminate egress. Endurer the SSH bastion with hardware key-based authentication or time sessions with JIT (just-in-time) and MFA reduces the utility of exfiltered keys. AWS provides practical guides on secret management and audit records that need to be consulted to adjust controls: AWS Secrets Manager - guide and AWS CloudTrail - registration guide.

In the detection layer there are specific signals that deserve rules and monitoring: access to Secrets Manager that match process activity in previously compromised hosts; short-term SSH session bursts towards multiple internal objectives; command patterns with delimiters or systematic stderr suppression; and call sequences that re-use previous step outputs (e.g., credentials file readings followed immediately by authentication). To correlate telemetry of host, network and cloud allows to raise more reliable alerts than those from a single source.

On the organizational level, it should be assumed that the emergence of LLM agents in offensive operations will transform the life cycle of the attack: defence teams should prioritize rapid recovery (rotation of credentials, revocation of access), segmentation of the environment and minimization of persistent secrets in user hosts. Tools such as ephemeral keys, short-life tokens, and the isolation of machine credentials by assuming roles rather than stored keys, raise the cost for an automated operator. To understand the specific vulnerability and its follow-up on public vulnerability bases, see the CVE tab in the NIST database: CVE-2026-39987 - NVD.

Finally, the adoption of proactive incident response strategies that consider the possibility of self-employed actors is essential. Simulate scenarios with stolen credentials, verify the detection of "agent-in-the-loop" patterns in purple team exercises, and keep up-to-date containment playbooks (isolation of instances, egress block, mass rotation of secrets) should be part of the continuity plan. The key message for technical and business equipment is clear: to park fast, to reduce the surface of persistent secrets and to raise telemetry and correlation so that an intelligent agent cannot move without leaving detectable traces.