Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig researchers highlight a case where a skilled human threat actor exploited a remote code execution (RCE) vulnerability in a Marimo notebook to pivot to an SSH bastion host in just eight seconds. The findings underscore that while AI is lowering the barrier for attackers and accelerating exploitation timelines, human operators remain highly capable of rapid post-exploitation movement. The incident demonstrates the speed at which attackers can escalate access after gaining an initial foothold in cloud environments. This research serves as a warning to organizations running Marimo notebooks or similar interactive computing environments about the risks of unpatched RCE vulnerabilities. The case highlights the need for robust lateral movement detection and network segmentation in cloud infrastructures.