{"uuid": "b3657a3c-ae33-40d8-b88f-338745c0fceb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-39987", "type": "seen", "source": "https://t.me/cibsecurity/89532", "content": "\ud83d\udd8b\ufe0f Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit \ud83d\udd8b\ufe0f\n\nAn unknown threat actor has been observed using a large language model LLM agent to conduct postcompromise actions after obtaining initial access following the exploitation of a publiclyaccessible Marimo network using a recently disclosed vulnerability.  \"The attacker compromised an internetreachable Marimo notebook via CVE202639987, extracted two cloud credentials from the compromised.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-05-29T18:12:18.000000Z"}