marimo

Incidents implicated systems

インシデント 16703 Report
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

2026-05-10

An unidentified attacker reportedly used an LLM agent during a May 10 intrusion after exploiting a vulnerable marimo Python notebook. The agent reportedly reused harvested AWS credentials to obtain an SSH key, then pivoted through a bastion host and exfiltrated the schema and contents of an internal PostgreSQL database. Sysdig attributed the post-compromise command stream to real-time agent execution rather than a prebuilt script.

Related Entities

Threat actors

Incidents involved as Deployer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

hackers

Incidents involved as Deployer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Cybercriminals

Incidents involved as Deployer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

AI agent system deployers

Incidents involved as Deployer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Agentic threat actors

Incidents involved as Deployer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Large language model developers

Incidents involved as Developer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

AI agent system developers

Incidents involved as Developer

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Victims of automated cybercrime

影響を受けたインシデント

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Enterprise IT systems

影響を受けたインシデント

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Amazon Web Services (AWS) customers

影響を受けたインシデント

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Information security

影響を受けたインシデント

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Privacy

影響を受けたインシデント

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

AI agent systems

Incidents implicated systems

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Large language models

Incidents implicated systems

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Amazon Web Services (AWS)

Incidents implicated systems

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

Amazon Web Services (AWS) cloud infrastructure

Incidents implicated systems

インシデント 1670
3 レポート
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook