Human attacker exploits Marimo RCE, reaches SSH bastion in eight seconds

A human attacker exploited a Marimo remote code execution flaw and reached an SSH bastion in eight seconds after initial access, The Hacker News reports, citing new findings from Sysdig released today. The case underscores that even as AI speeds automated exploitation, skilled human operators can move just as quickly once inside, shrinking defenders’ response windows. The stakes are high for teams running interactive notebooks and relying on bastion hosts to gate access.

According to The Hacker News, Sysdig observed the intruder pivot from a vulnerable Marimo notebook to the organization’s SSH bastion almost instantly, demonstrating rapid reconnaissance and lateral movement without lengthy tooling setup. Watch for patch or mitigation guidance for Marimo, additional technical indicators from Sysdig, and any signs of copycat activity. [Developing. This article will be updated.]