Sysdig marimo: When an LLM Agent Drives Post-Exploitation After RCE

Why this analysis has no ERS

There is no assessed AI system on the victim side. The compromised asset is a marimo notebook runtime — a browser-based interactive Python execution environment used for AI and data-science work — reached through CVE-2026-39987 on its /terminal/ws WebSocket. It contains no model, no retrieval layer, no tool-calling interface and no agent: nothing in the deployed victim system produces or consumes model output. The only AI agency in this incident belonged to the attacker's post-exploitation tooling, and protocol section 1 places the attacker out of scope. Consequently the AITBM architecture decision tree (spec 4.4) has no class that fits without misrepresentation: Q1 through Q5 are all NO, and the Q6 fall-through to Traditional ML / Classifier would be factually wrong for a code-execution surface with no model. Every IVP axis that gives AITBM its distinctive signal — Robustness, Fairness, Transparency's explainability and calibration sub-metrics, Privacy's model-behaviour sub-metrics — is unassessable, and what remains (network scope, credential hygiene, segmentation, telemetry) is conventional infrastructure security that AITBM does not exist to score. Forcing a score here would produce an ERS driven almost entirely by ORP with a Containment-only IVP, which would misrepresent both the incident and the framework. The correct AITBM treatment of this case is as an input to other assessments rather than as an assessment of its own: it is a spec 3.3.3.4 threat-override condition (a new exploited vulnerability with an active incident, M_threat = 1.50, Tf capped at 0.50 for exploited relevance) for any AI workload hosted on or reachable from such runtimes, and an exposure-management finding for AI development surfaces generally.

Classification: Incident · source date 2026-06-06