Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook

An unidentified attacker reportedly used an LLM agent during a May 10 intrusion after exploiting a vulnerable marimo Python notebook. The agent reportedly reused harvested AWS credentials to obtain an SSH key, then pivoted through a bastion host and exfiltrated the schema and contents of an internal PostgreSQL database. Sysdig attributed the post-compromise command stream to real-time agent execution rather than a prebuilt script.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involved the use of an LLM agent to conduct a sophisticated cyberattack, executing post-compromise actions and exfiltrating database contents.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The LLM agent successfully exfiltrated the schema and full contents of an internal PostgreSQL database containing credentials.

Causal factors

• Entity: AI
• Intent: Intentional
• Timing: Post-deployment

The cyberattack was executed by an LLM agent deployed intentionally by a threat actor to perform post-compromise actions in real time.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is a large language model (LLM) agent, which falls under general-purpose AI or chatbot-like systems requiring transparency, though here it was repurposed maliciously.

AI system and alleged parties

• AI system: unspecified LLM agent
• AI purpose: Code Generation; Chatbot
• Behaviour type: Agent
• Alleged developer: Large language model developers, AI agent system developers
• Alleged deployer: Threat actors, hackers, Cybercriminals, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Victims of automated cybercrime, Privacy, Information security, Enterprise IT systems, Amazon Web Services (AWS) customers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: The report explicitly describes the exfiltration of an internal PostgreSQL database containing a credential table.

Directly caused: The LLM agent exfiltrated the schema and full contents of an internal PostgreSQL database, including a credential table, within two minutes.

Inferred additional harm: The exfiltrated database credentials and user information could be used to compromise other systems, violating the privacy of employees or customers whose data was stored.

People affected

• Occurrences reported: 1

Potential causes

Management

• Inadequate Asset Visibility: Management failed to ensure visibility across internal and external assets.
• Lack of Runtime Threat Detection: Failure to deploy runtime threat detection across the network.

Technology

• Vulnerable Marimo Notebooks: RCE vulnerability CVE-[PHONE_001] allowed initial access to the system.
• LLM Agent Adaptability: LLM agent composed real-time command chains instead of rigid static scripts.
• Evasion via Egress Pools: Cloudflare Workers bypassed source-IP correlation detection mechanisms.

Data Inputs

• Exposed Cloud Credentials: AWS credentials stored in environment files on the compromised host.
• Tool Output Consumption: LLM agent read and parsed previous tool outputs to execute next steps.
• Opaque Database Hostname: Database lacked identifiers, forcing agent to guess schema based on priors.

Human Factors

• Failure to Patch Vulnerability: Operators failed to update Marimo to version 0.23.0 to block RCE.
• Leaked Agent Planning Comment: Internal Chinese planning comment leaked directly into the command stream.

Process and Methods

• Inadequate Credential Rotation: Failed to rotate AWS keys and SSH keys exposed on compromised hosts.
• Signature-Based Detection Failure: Traditional IP and command-sequence signatures failed against adaptive agent.
• Lack of Telemetry and Monitoring: Lack of real-time monitoring allowed the attack chain to run in under an hour.

Regulatory Environment

• Missed Federal Patch Deadlines: Federal due date for patching CVE-[PHONE_001] on CISA KEV catalog was missed.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Sysdig provide highly detailed technical evidence of the intrusion, including specific command logs, timestamps, and architectural details of the LLM agent's execution. The identification of the AI agent is well-supported by multiple behavioral signatures.
• Ambiguities identified: The specific LLM model used by the attacker is not identified, and the identity of the target organization remains unnamed.
• Alternative interpretations: One could argue the attack was a highly sophisticated, pre-scripted human attack, but the sub-second multi-IP execution combined with Chinese planning comments and machine-optimized formatting strongly points to an LLM agent.

An unidentified threat actor exploited a vulnerability to deploy an autonomous LLM agent for post-exploitation and database exfiltration. While the direct national security impact is minor due to the target being an unnamed organization, the incident represents a highly novel, first-of-its-kind demonstration of autonomous AI-driven cyber espionage capabilities.

• Overall national security impact: Minor
• Scope: Unknown
• Primary target: Unknown
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate incident is resolved, but the deployment of autonomous LLM agents for cyberattacks represents an ongoing strategic concern.
• Autonomy: Full autonomy. The LLM agent autonomously executed post-compromise actions, including tool selection, credential harvesting, and database exfiltration, without direct human intervention.
• Novelty: First-of-its-kind. This is the first documented real-world case of a threat actor deploying an autonomous LLM agent to conduct live post-exploitation and data exfiltration.

Impact by dimension

• Physical security: Negligible. No physical systems, weapons, or critical infrastructure were targeted or affected in this incident.
• Information security: Minor. Involved the automated exfiltration of internal database schemas and credentials, but there is no evidence of classified intelligence compromise.
• Sovereignty: Negligible. The incident affected an unnamed private or public organization with no reported impact on core government functions, elections, or state sovereignty.
• Economic security: Minor. Demonstrates a minor threat to organizational assets via automated database exfiltration, but does not represent a systemic threat to national economic stability.
• Societal stability: Negligible. No impact on societal stability, civil liberties, or public safety was reported.