AI‑agent‑driven intrusion exfiltrates internal DB via LLM‑orchestrated pivots
Sysdig’s Threat Research Team recorded the first known AI‑agent‑driven intrusion, where an attacker exploited a marimo notebook CVE, leveraged LLMs to orchestrate four rapid pivots, and exfiltrated an internal PostgreSQL database in under two minutes using Cloudflare Workers as a distributed egress pool. The team details the attack chain and offers detection and remediation guidance.