Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Cloud security company Sysdig reported a rapid exploitation incident involving a Marimo notebook vulnerability. In the highlighted case, a skilled human threat actor exploited a remote code execution (RCE) flaw in a Marimo notebook to gain initial access. The actor then pivoted to an SSH bastion host in approximately eight seconds, demonstrating the speed of manual exploitation by experienced operators.

The findings come as artificial intelligence is shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors. Sysdig's report emphasizes that while AI enables less skilled actors to launch attacks, skilled human operators remain capable of moving just as swiftly once they have initial access.

The specific Marimo RCE vulnerability was not assigned a CVE in the reporting, and the identity of the threat actor remains unconfirmed. Sysdig noted that the full extent of the impact is not disclosed, but the rapid pivot to an SSH bastion suggests the actor was targeting credential access or lateral movement into sensitive systems. Organizations using Marimo notebooks are advised to monitor for security advisories from the vendor and apply updates as they become available.