OOF-AII-028956
Threat Actor Reportedly Used LLM Agent to Exfiltrate Internal Database After Compromising marimo Python Notebook
An unidentified attacker reportedly used an LLM agent during a May 10 intrusion after exploiting a vulnerable marimo Python notebook. The agent reportedly reused harvested AWS credentials to obtain an SSH key, then pivoted through a bastion host and exfiltrated the schema and contents of an internal PostgreSQL database. Sysdig attributed the post-compromise command stream to real-time agent execution rather than a prebuilt script.
- Event date
- 2026-05-10
- Country
- Location not specified
- Severity
- Moderate
- Evidence state
- Single-source
Assessment status
Generated from available public incident evidence using OOF® governance methodology. It is not an official investigation, legal determination, regulatory finding, certification, or OOF® Approved Assessment.
View source record from AI Incident Database (Responsible AI Collaborative)
Assessment confidence dimensions
- Source corroboration
- Single-source
- Extraction completeness
- Moderate
- Methodological assignment confidence
- Limited
Measures source-group corroboration only; it does not establish factual truth.
Measures populated source fields after deterministic normalization; it does not measure correctness.
Measures automated assignment support; substantive correctness requires authorized human review.
Known facts from the incident record
- The incident record identifies the event date as 2026-05-10.
Reported claims
- An unidentified attacker reportedly used an LLM agent during a May 10 intrusion after exploiting a vulnerable marimo Python notebook. The agent reportedly reused harvested AWS credentials to obtain an SSH key, then pivoted through a bastion host and exfiltrated the schema and contents of an internal PostgreSQL database. Sysdig attributed the post-compromise command stream to real-time agent execution rather than a prebuilt script.
Material unknowns
- Independent corroboration is not established in the available incident record.
Primary governance problem
The incident appears to expose a governance problem involving agent. Available reporting supports preliminary methodological interpretation, not a finding of fault or non-compliance.
Architecture intelligence
CLIA® — Cognitive Governance Intelligence Architecture
Primary architecture
The reported agent concern falls within the governed questions represented by CLIA® — Cognitive Governance Intelligence Architecture.
Governance focus: How should agent be governed in the conditions described by the available incident evidence?
Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.
MGIA™ — Memory Governance Intelligence Architecture
Contributing architecture
The reported agent concern falls within the governed questions represented by MGIA™ — Memory Governance Intelligence Architecture.
Governance focus: How should agent be governed in the conditions described by the available incident evidence?
Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.
ORA™ - Operational Reality Architecture
Contributing architecture
The reported agent concern falls within the governed questions represented by ORA™ - Operational Reality Architecture.
Governance focus: How should agent be governed in the conditions described by the available incident evidence?
Deeper methodology is withheld because the available evidence does not justify a Parent Standard or Core Module.
Preliminary governance questions
- How should agent be governed in the conditions described by the available incident evidence?
- What operational authority and controls applied to Threat Actors, Hackers, Cybercriminals, Ai Agent System Deployers, Agentic Threat Actors at the relevant time?
- What evidence would establish how Ai Agent Systems, Large Language Models, Amazon Web Services (Aws), Amazon Web Services (Aws) Cloud Infrastructure, Marimo produced or enabled the reported outcome?
- What additional independent evidence is required to resolve the material evidence gaps?
Evidence gaps and limitations
- Only one independent source group is represented; corroboration is not established.
- Country could not be resolved from the available evidence.
- AI technology is not specified in the source record.
- industry is not specified in the source record.
- AI system type is not specified in the source record.