Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Sysdig observed an intrusion on May 10 2026 in which an attacker reached an internet-facing marimo notebook, gained command execution through CVE-2026-39987 on the /terminal/ws WebSocket, and then used an LLM agent to drive post-exploitation across four pivots. The session first harvested credentials, reading environment files, .env paths, process environments and ~/.aws/credentials, then used the harvested AWS keys to call STS and Secrets Manager. It retrieved an SSH private key from Secrets Manager, used Cloudflare Workers as an egress pool, and opened eight short SSH sessions to a downstream bastion.
From the bastion it enumerated PostgreSQL tables, guessed high-value AI-workflow tables, and exfiltrated schema and contents in under two minutes. Sysdig's evidence for the agent's involvement is the command stream itself: a leaked planning comment, delimiter-heavy shell blocks, bounded output captures, a single psql heredoc, and values lifted from prior tool output. Sysdig's own conclusion is that the LLM did not invent a new exploit — it made post-exploitation cheaper, faster and more adaptive after a conventional remote code execution.
Why this analysis has no ERS
Sysdig confirmed attacker-side LLM-agent post-exploitation of a marimo notebook, cloud credentials, a bastion, and a database. It did not identify an affected AI model or agent on the victim side whose boundary can inherit this host compromise.
Status: Not scorable by design · Classification: Incident · source date 2026-06-06
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-004.001 | User & Privileged Access ManagementParent AID-H-004 (Identity, Access & Trusted Communication for AI Systems), dataVersion 2026.10.15. Mapping recorded for reference only; no AITBM sub-metric is scored in this case. Substantively: requiring an authenticated user with MFA and privileged-session controls before a terminal can be created is what would have stopped an anonymous browser request becoming a host shell. | Very High | Tr-3 Cn-5 |
| AID-I-001.004 | Sandbox Network Egress RestrictionsParent AID-I-001 (AI Execution Sandboxing & Runtime Isolation), dataVersion 2026.10.15. Mapping recorded for reference only. The parent's Pr-2 leg is not evidenced by this incident; the control's actual effect here is on outbound reach to cloud APIs, Cloudflare Workers, SSH and the internal database path. | Very High | Pr-2 Cn-7 |
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryParent AID-M-001 (AI Asset Inventory & Mapping), dataVersion 2026.10.15. Mapping recorded for reference only. This is the control class that makes the case useful as an exposure-management input: probing organisation-owned notebook and agent routes from an untrusted vantage point and reconciling each to ownership and authentication posture. | Very High | Fa-3 Tr-4 Cn-5 |
| AID-I-002.001 | Internal AI Network SegmentationParent AID-I-002 (Network Segmentation & Isolation for AI Systems), dataVersion 2026.10.15. Mapping recorded for reference only; the parent's Cn-4 side-channel leg is not what this control addresses here, which is preventing a public-facing notebook from reaching high-value internal data stores and administrative jump paths. | High | Cn-4 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleParent AID-H-003 (Secure ML Supply Chain Management), dataVersion 2026.10.15. Mapping recorded for reference only. Substantively this is the control that owns the actual root cause: reconciling every deployed marimo version against the advisory and verifying no vulnerable runtime remains internet-reachable. | High | Ro-4 Ro-5 Tr-4 |
| AID-D-005.003 | Proactive AI Threat HuntingParent AID-D-005 (AI Activity Logging, Monitoring & Threat Hunting), dataVersion 2026.10.15. Mapping recorded for reference only. Notable for AITBM's threat model: Sysdig's point is that hypothesis-driven hunting finds the same attacker objective even when an agent composes a different command sequence each time, which is precisely why signature-based detection degrades against AI-assisted post-exploitation. | High | Tr-3 Cn-7 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionParent AID-E-001 (Compromised Credential, Session, Principal & Grant Eviction), dataVersion 2026.10.15. Mapping recorded for reference only. Long-lived AWS keys, SSH material and database passwords reachable from the runtime process are what turned initial access into four pivots. | Medium | Cn-5 |