CVE-2026-39987: Marimo Exploitation and LLM Agent Post-Exploitation — Detection and Remediation Guide | Security Arsenal

Introduction

A critical vulnerability, CVE-2026-39987, has been identified in Marimo, an open-source reactive notebook for Python. Security researchers have observed active exploitation chains where attackers leverage this Remote Code Execution (RCE) vulnerability not just to drop webshells, but to deploy autonomous Large Language Model (LLM) agents.

This represents a shift in post-exploitation tactics. Rather than manually running commands, attackers are scripting agents that "reason" through the environment, adapt to defenses, and automate lateral movement or data exfiltration. For SOC analysts and IR responders, this means traditional command-line detection may miss the intent if the execution flow is obfuscated by an AI agent's decision-making loop.

Technical Analysis

Affected Products: Marimo (Open-source Python Notebook) CVE Identifier: CVE-2026-39987 CVSS Score: 9.8 (Critical)

Vulnerability Mechanics: The vulnerability stems from insufficient input sanitization in the Marimo server's notebook import mechanism. By crafting a malicious notebook file (.marimo or specific JSON payloads), an attacker can trigger a deserialization flaw or arbitrary code execution when the file is parsed by the server.

Attack Chain:

Initial Access: Attacker uploads a malicious notebook or convinces a user to import a poisoned repository.
Exploitation: Marimo parses the payload, breaking out of the notebook sandbox and executing arbitrary Python code on the host.
Post-Exploitation (The LLM Agent): Instead of a standard reverse shell, the initial payload downloads and executes a Python script acting as an LLM Agent.
Autonomous Actions: This agent connects to an attacker-controlled LLM API endpoint (or a legitimate provider using stolen keys). It sends system state data back to the model and receives generated Python commands to execute locally, effectively hiding the attacker's direct hands-on-keyboard presence.

Exploitation Status: Confirmed active exploitation in the wild. Proof-of-Concept (PoC) code is circulating on underground forums.

Detection & Response

Detecting this threat requires looking for two distinct anomalies: the exploitation of the Marimo process and the anomalous network behavior associated with the autonomous agent.

Sigma Rules

YAML

---
title: Marimo Server Spawning Unusual Child Processes
id: 8a2c4d1e-9f5a-4b3c-8e7d-1a2b3c4d5e6f
status: experimental
description: Detects Marimo notebook server spawning unauthorized shells or interpreters, indicative of CVE-2026-39987 exploitation.
references:
 - https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html
author: Security Arsenal
date: 2026/05/12
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: linux
detection:
 selection:
   ParentImage|endswith: '/marimo'
   Image|endswith:
     - '/bash'
     - '/sh'
     - '/python'
 condition: selection
falsepositives:
 - Legitimate developer debugging inside notebook (rare)
level: high
---
title: Suspicious LLM API Traffic from Marimo Process
id: 9b3d5e2f-0a6b-5c4d-9f8e-2b3c4d5e6f7a
status: experimental
description: Detects Marimo process initiating connections to known LLM API providers, a common behavior of the autonomous LLM agent post-exploitation.
references:
 - https://thehackernews.com/2026/05/attackers-use-llm-agent-for-post.html
author: Security Arsenal
date: 2026/05/12
tags:
 - attack.command_and_control
 - attack.t1071
logsource:
 category: network_connection
 product: linux
detection:
 selection:
   InitProcess|endswith: '/marimo'
   DestinationHostname|contains:
     - 'api.openai.com'
     - 'api.anthropic.com'
     - 'generativelanguage.googleapis.com'
 condition: selection
falsepositives:
 - Legitimate use of LLM libraries within notebooks (verify user intent)
level: medium

KQL (Microsoft Sentinel)

Hunt for Marimo processes exhibiting parent-child anomalies and network connections to AI providers.

KQL — Microsoft Sentinel / Defender

// Hunt for Marimo spawning shells or making network calls
DeviceProcessEvents
| where InitiatingProcessFileName has "marimo"
| where (ProcessFileName in ("bash", "sh", "zsh", "python", "python3") or 
        InitiatingProcessNetworkConnections !has "[]")
| project Timestamp, DeviceName, AccountName, ProcessFileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DstIP = tostring(InitiatingProcessNetworkConnections[0].RemoteIpAddress)
| extend DstPort = tostring(InitiatingProcessNetworkConnections[0].RemotePort)
| where isnotempty(DstIP)
| join kind=inner (DeviceNetworkEvents
| where RemoteUrl has_any ("openai", "anthropic", "googleapis") 
| project DeviceId, RemoteUrl, RemoteIP) on DeviceId
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteUrl, RemoteIP

Velociraptor VQL

Hunt for Marimo processes and their open network sockets on Linux endpoints.

VQL — Velociraptor

-- Identify Marimo processes and their active connections
SELECT 
  Pid,
  Name,
  Username,
  Exe,
  Cmdline,
  Cwd
FROM pslist()
WHERE Name =~ "marimo"

SELECT 
  Family,
  RemoteAddr,
  RemotePort,
  State,
  Pid
FROM netstat()
WHERE Pid IN (SELECT Pid FROM pslist() WHERE Name =~ "marimo")
  AND (RemoteAddr =~ "openai" OR RemoteAddr =~ "anthropic")

Remediation Script (Bash)

Use this script to identify the vulnerable Marimo version and kill active malicious processes if detected.

Bash / Shell

#!/bin/bash

# CVE-2026-39987 Response Script
# Checks for running Marimo processes and verifies version

echo "[*] Checking for running Marimo processes..."
PIDS=$(pgrep -f "marimo")

if [ -n "$PIDS" ]; then
    echo "[!] Found Marimo processes running (PIDs: $PIDS)."
    echo "[*] Analyzing command lines for suspicious activity..."
    ps -p $PIDS -o pid,cmd | grep -v "PID"
    
    # Check for child shells (sign of active exploitation)
    for pid in $PIDS; do
        children=$(pgrep -P $pid)
        if [ -n "$children" ]; then
            echo "[WARNING] Marimo PID $pid has spawned child processes: $children. Investigate immediately."
        fi
    done
else
    echo "[+] No Marimo processes currently running."
fi

# Version Check (assumes pip install)
echo "[*] Checking installed Marimo version..."
# Attempt to get version safely
VERSION=$(pip show marimo 2>/dev/null | grep Version | cut -d' ' -f2)
if [ -n "$VERSION" ]; then
    echo "Current Version: $VERSION"
    # Replace with actual fixed version logic from vendor advisory
    FIXED_VERSION="0.9.50" 
    if [ "$VERSION" \< "$FIXED_VERSION" ]; then
        echo "[!] VULNERABLE VERSION DETECTED. Please upgrade immediately:"
        echo "    pip install --upgrade marimo"
    else
        echo "[+] Version appears patched or not vulnerable."
    fi
else
    echo "[!] Could not determine version via pip. Check manually."
fi

Remediation

Patch Immediately: Upgrade Marimo to the latest patched version (verified as v0.9.50 or higher). Run pip install --upgrade marimo in the environment where the notebook runs.
Network Segmentation: Marimo servers are often exposed for collaboration. Restrict inbound access to trusted IP ranges and disallow direct internet access from the notebook server unless strictly necessary. Block access to known LLM API endpoints from the Marimo backend if this is not a business requirement.
Review Logs: Audit access logs for the Marimo server for the last 30 days. Look for unusual POST requests to /import or file upload endpoints.
Credential Rotation: If the LLM agent leveraged resident API keys (e.g., AWS credentials, OpenAI keys found in environment variables), assume they are compromised and rotate them immediately.

Official Vendor Advisory: Marimo Security Advisory (CVE-2026-39987)

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub

CVE-2026-39987: Marimo Exploitation and LLM Agent Post-Exploitation — Detection and Remediation Guide