Breach Record

marimo

DISCLOSED 2026-05-26 · STOLEN CREDS

An attacker used an LLM agent to conduct post-exploitation after compromising a marimo notebook via CVE-2026-39987. The agent harvested cloud credentials, retrieved an SSH key from AWS Secrets Manager, and exfiltrated an internal PostgreSQL database in under two minutes, using Cloudflare Workers to evade source-IP detection.

The record

What we know

Disclosed

2026-05-26

Attack vector

Stolen Creds

Sources

Cited reporting

↗ www.sysdig.com (2026-05-26) ↗ The Hacker News (2026-05-29)

Similar vector · recent

Other stolen creds breaches on file

This page is the permanent ColdRecon entry for the marimo disclosure. It updates if new public reporting emerges. All tracked breaches →

marimo just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →