Security vendors have spent this year building detections tuned to catch one thing: attacks that move faster than a human plausibly could. New research from Sysdig should worry anyone who bet their detection strategy on that assumption, because it documents a threat actor who moved at that exact speed using nothing but skill and a keyboard.
The Case Against Speed as a Signal
The Sysdig Threat Research Team watched an attacker exploit CVE-2026-39987, a pre-authentication remote code execution flaw in the marimo notebook tool, then pivot from an open WebSocket terminal to a live SSH session on a bastion host in eight seconds. In between, the operator harvested cloud credentials from AWS Secrets Manager and replayed a retrieved SSH key against an internet-reachable bastion. Over a nine-hour session they issued more than 850 interactive commands. There was no AI agent involved, no LLM-generated script, and no publicly available offensive tool in the chain. The operator wrote and debugged their own Python toolkit by hand, in session, over the preceding four hours. “Eight seconds is the kind of speed we expect to see in AI-assisted attacks,” the Sysdig Threat Research Team said. “This operator got there on skill alone, and along the way walked straight past a trap that every agentic threat actor we’ve profiled against this same CVE fell into.”
That last detail is the one that should reframe how defenders think about attack speed. Sysdig had already profiled multiple automated, AI-driven operators against the identical vulnerability, and had built a detection designed to catch them. Every one of those automated actors tripped it. The human operator did not, precisely because the trap was built to catch the fingerprints of automation: recognizable tooling, LLM-generated code patterns, a planted prompt injection an AI agent would follow. A skilled human simply does not leave those fingerprints, even while moving at the same speed.
Media Partner
The Counter-Argument, and Why It Doesn’t Rescue the Current Approach
The obvious objection is that AI-specific detection still matters more in aggregate, because AI-driven attacks scale across thousands of targets simultaneously in a way one skilled human cannot replicate, so this single case is an outlier rather than a reason to deprioritize AI-behavior detection. That is a fair point about AI’s advantage in breadth, and it is not an argument against building AI-aware detection. But it does not answer the actual failure this research exposes. Sysdig describes this operator as one of several it has profiled against the same CVE, and the distinguishing fact is not that this one was human, it is that this one deliberately avoided every signature the others left behind, including a prompt injection lure built specifically to catch agent-driven actors. That is not an outlier behavior confined to one bastion host. It is evidence that skilled adversaries, human or otherwise, adapt to whatever signal defenders start relying on, and “this moved at AI speed” or “this looks automated” are both signals that a patient attacker can simply decline to produce.
What It Means for the Security Leader
The practical failure is treating “was this AI?” as the question worth answering in the SOC in the first place. It is the wrong question for a detection engineer to key an alert on, because the answer changes nothing about what the attacker actually did: an unauthenticated exploit against an exposed service, an unauthorized Secrets Manager call, a credential replayed against a bastion host it was never meant to be reachable from. Those are the same indicators whether the operator behind them is a script, a model, or a person with four hours and a text editor. CyberTech has already documented how autonomous AI operations are running real campaigns with minimal human supervision and how AI is shrinking the gap between a patch and its exploitation. Both are real and both deserve dedicated attention. But this research is a warning against a specific mistake sitting underneath that coverage: building detection logic around the premise that speed or automation-looking behavior is itself the tell, rather than around the underlying action an attacker has to take regardless of what is typing the commands.
The Fix Is Activity-Based, Not Attribution-Based
Security teams that have not already done so should audit their detection rules for the ones quietly built on an “this looks automated” or “this happened too fast to be human” assumption, because those are the rules a patient, skilled operator can walk straight past, as this one did. The controls that would have caught this operator regardless of who or what they were, tighter secrets manager access scoping, alerting on any credential harvested from one service being replayed against an unrelated internet-facing host, and treating bastion hosts as reachable-from-nowhere by default, are the same controls organizations should have been running before anyone worried about AI attackers. That they also happen to close the gap this research exposes is the point. Detection built on what an attacker does will catch the human and the machine. Detection built on how fast or how polished the attack looks will eventually catch neither.
Source: Sysdig
