Human Hacker Breaks Out of Marimo Notebook and Hits SSH Bastion in Eight Seconds
Sysdig researchers watched a skilled attacker chain a Marimo flaw into deeper cloud access almost instantly, showing humans can move as fast as AI.
Key points
- Cloud security firm Sysdig recorded a human attacker moving from a vulnerable Marimo notebook to an SSH bastion in about eight seconds.
- The initial foothold came from a Marimo notebook exposed to the internet, letting the attacker run code on the server.
- SSH is Secure Shell, the standard remote-login tool engineers use to reach servers; a bastion is the single guarded gateway to the rest of a cloud network.
- Sysdig frames the case as evidence that skilled operators, not just AI tools, are closing the gap between finding a flaw and exploiting it.
- No victim organisation or data theft was named in the disclosure.
A skilled human attacker jumped from a vulnerable data-science notebook to a company's main cloud gateway in roughly eight seconds, according to new research from Sysdig, a cloud security company.
The case undercuts the usual story about speed. Everyone talks about artificial intelligence shortening the window between a flaw being found and criminals abusing it. Sysdig's finding is quieter and more useful: a practised human with the right access moves just as fast.
What actually happened?
Researchers at Sysdig watched an attacker break in through a Marimo notebook, a browser-based tool that data scientists use to write and run Python code. The notebook was reachable from the open internet and carried a flaw that let the attacker run their own commands on the underlying server. We covered the underlying vulnerability on 25 August 2026, when Marimo patched a bug that let hidden commands run the moment a user opened a booby-trapped file.
From there, the attacker pivoted to an SSH bastion. SSH, short for Secure Shell, is the standard way engineers log into remote machines. A bastion is the one hardened server at the edge of a cloud network that gatekeeps everything behind it. Reach it and you're one hop from the crown jewels.
Notebook to bastion: eight seconds.
Who is behind it?
Sysdig hasn't named the attacker or a country of origin. The framing is behavioural: this was a person at a keyboard, not an automated script, and their tradecraft was clean enough that the jump looked instant.
No ransom demand or data-leak listing has been tied to the case. That fits Sysdig's remit, which is telemetry from customer cloud environments rather than leak-site monitoring.
Why does eight seconds matter?
Because most detection tools assume they have minutes. Cloud alerts get batched. Analysts triage in a queue. If an attacker is inside the bastion before the first alert renders on a screen, the containment playbook has already lost a round.
The Marimo angle is worth flagging on its own. Data-science tools like Jupyter and Marimo are often stood up quickly by research teams, left exposed while someone iterates, and never handed to the security team for review. They run code by design. That's also what makes them a clean initial-access route when they face the internet.
What should ordinary readers take from this?
Nothing to do at home. This is an enterprise cloud story, not a consumer breach. If you work somewhere that runs Python notebooks for analytics or machine learning, the practical question for your IT team is whether any of those notebooks are reachable from the public internet, and if so, why.
The reporter's read: the AI-versus-human framing around attack speed is getting tired. Skilled operators have always been fast. What's new is that cloud environments give them more ground to cover in fewer hops, so eight seconds now buys what used to take a weekend. Our earlier story on AI agents breaking cloud security made the automation case; this one is the human rebuttal. Watch for more incident writeups measured in seconds, not days.
The Hacker News first surfaced the Sysdig findings.
