First confirmed LLM agent cyberattack exfiltrated AWS database in under an hour

Sysdig documented something the security industry has been warning about but had not yet seen in the wild: a large language model agent autonomously performing post-exploitation in a real attack. The target was an AWS-hosted PostgreSQL database. The entire chain, from initial access to exfiltration, took a little over an hour.

The attack happened on May 10, 2026. The entry point was CVE-2026-39987, a pre-authentication remote code execution vulnerability in Marimo notebooks. An unauthenticated attacker hit a publicly accessible Marimo instance, got a shell, and from there the LLM agent took over.

What the agent did next is the part that should make security teams uncomfortable. It extracted two cloud credentials from the compromised host. It replayed those credentials through a fanned-out egress pool to pull an SSH private key from AWS Secrets Manager. It then used that key to open eight parallel SSH sessions against a downstream bastion server. Through the bastion, it dumped the schema and full contents of an internal PostgreSQL database in under two minutes.

No human directed any of those steps.

Sysdig identified four indicators that an LLM agent was driving the attack. First, the agent improvised a database dump with zero prior knowledge of the schema. The database hostname was opaque, no application identifier on disk, no schema dump pre-staged. The chain still landed on a credential table within minutes. Second, a Chinese-language planning comment leaked directly into the command stream: “看还能做什么”, which translates to “See what else we can do.” That is an AI planning token accidentally exposed in execution output. Third, every command was formatted for machine consumption, with “—” delimiters between commands, bounded output captures, stderr deliberately discarded to minimize noise, and the less pager disabled. Fourth, value handoffs came from the agent’s own prior output. When the agent needed a database password, it ran cat ~/.pgpass and fed the result straight into the next connection attempt. When it needed an SSH key, it ran ls -la ~/.ssh/id_ed25519* first to confirm the file existed, then cat ~/.ssh/id_ed25519 to read it.

This is the operational profile of an adaptive attacker, not a scripted one. A scripted operator hits a missing file or an unexpected schema and either aborts or falls through to a hardcoded fallback. An agent reads the surprise, decides what to try next, and keeps going. The barrier to conducting post-exploitation has shifted from “skilled human red team” to “LLM API access plus knowledge of a working CVE.”

The broader context is worse. A separate vulnerability, CVE-2026-48710, dubbed “BadHost,” was disclosed in Starlette, the Python ASGI framework that underpins FastAPI, vLLM, LiteLLM, and every MCP server built on those frameworks. Starlette has 325 million weekly downloads. BadHost is a host header injection that lets unauthenticated attackers bypass authentication with a single malformed HTTP header. Ars Technica called it a vulnerability that imperils millions of AI agents. The patch exists. The patching rate is the question.

CrowdStrike’s latest data puts the average attacker breakout time at 29 minutes. That number was already tight for human defenders. An LLM agent does not need sleep, does not need to look up syntax, and does not second-guess itself. The timeline from initial access to data loss in the Sysdig incident was already fast. The next one will be faster.

Patch Marimo to 0.23.0 or later. Patch Starlette to 1.0.1 or later. Rotate any credentials that were exposed to internet-reachable notebooks. And assume that “post-exploitation requires a skilled human” is no longer a valid threat model.