Some attacks force us to stop and acknowledge that the ground has shifted beneath our feet. This is one of them. On 29 May 2026, Sysdig's threat research team observed something that marks a transition many of us had long anticipated: an end-to-end attack driven not by a human at the keyboard, but by an autonomous agent backed by a large language model. It was not a human deciding the next step. It was a machine.
First of all, it is worth dismantling a misconception that tends to contaminate this kind of news. The temptation is to say that the AI "invented" a new attack, that it discovered exploitation paths that escape us. It was nothing of the sort, and it is important to be rigorous. The techniques used are textbook: enumerating the exposed Docker socket, creating a privileged container to break out onto the host, reading the shadow file and SSH keys, and replaying a Kubernetes service account token to empty the cluster's Secret store. Any practitioner recognises these primitives. The entry point was, in fact, mundanely human: an outdated and vulnerable marimo notebook (CVE-2026-39987), fixable with a one-line patch.
So where is the real novelty? It lies in the autonomy, the speed and the behaviour. And this is where the case becomes genuinely fascinating, and worrying. The detail that, for me, is the true signature of the machine is not any spectacular exploit: it is the fact that the agent tested its own delivery channel before using it. It wrote disposable canary payloads (first a simple "hello", then a chunked "hello" followed by "world") just to confirm that the write-base64, append and decode mechanism worked, before trusting it with the real escape code. No human attacker, at an interactive shell, wastes time running unit tests on their own tunnel. This is the behaviour of an autonomous harness, methodical and patient in the manner of a machine.
The second signal is even more revealing for anyone who does forensics. The agent acted on directives hidden in the response stream itself: a canary planted in a JSON error and an invisible escape sequence in the terminal stream. A human would never notice such elements; they would skim right past them. But an agent that reads the entire stream as authoritative context acts on them. This is precisely what gave away the operator's non-human nature. This changes how the artefacts are read: I have stopped looking only for the errors and hesitations typical of a human and started looking for the mechanical regularity, the section markers (===SHADOW===, ===SSH===) that let the agent's next turn slice the output, and the systematic retries that adapt to the previous result.
The choice of target, the orchestration plane, is what turns this from an incident into an alarm. Compromising Kubernetes is not escaping an isolated container; it is gaining access to the layer that governs the entire infrastructure. A single service account token, mounted in a reachable pod and bound to an overly permissive RBAC, let the agent jump from an application-layer RCE to the cluster's full Secret store: database credentials, AWS keys, an OpenAI API key, a Slack webhook. In a single move. Those Secrets are the seed material for the next leap: cloud, databases, servers. It is a domino effect that begins in a misconfiguration and ends in total exposure.
Here I want to be clear on a point where I disagree with some of the more alarmist narrative, and where Sysdig itself is honest: this does not make traditional defences obsolete; it makes them more urgent than ever. Host-level detections for these techniques already exist and work. The container-escape and token-replay stages are, in fact, where the defender has the most signal to detect. What changed was not the effectiveness of the defences; it was the time window. What used to be a slow escalation, at the pace of a human thinking between commands, is now a takeover of the host and the cluster that runs at machine speed, with the agent trying escape primitives in parallel until one works. Configuration hygiene, which we have always treated as tedious and postponable, has become the front line.
In practice, the priorities are concrete, not abstract. Update marimo to version 0.23.0 or later; it is literally a one-line patch. Never, under any circumstances, mount /var/run/docker.sock inside an application container: mounting that socket is equivalent to handing over host root. Run containers unprivileged, with a read-only filesystem, dropped capabilities and a restrictive seccomp profile. Tightly scope Kubernetes service account tokens: disable automount where it is not needed, use short-lived tokens, and tighten RBAC so that a single workload's token cannot list and read Secrets across the namespace, let alone the entire cluster. And rotate anything that has been exposed.
Let me leave a final, more fundamental reflection. For years, our mental model of the attacker was a human, with fatigue, with hesitation, with an opportunity cost at every step. That model is crumbling. When the attacker is an agent that does not sleep, does not slip through distraction, tests its own tooling and adapts its strategy to each response in milliseconds, the asymmetry between attack and defence worsens. The good news, and I will end here, is that the agent is not magic: it still depends on the same open doors we have always been careless about closing. The difference is that we no longer have the luxury of time to close them afterwards. We have to close them beforehand.
Source: [Sysdig], research by Michael Clark, Sysdig Threat Research Team, 4 June 2026.
#StaySafe
🙏🖖
