A human attacker has moved from a vulnerable Marimo notebook to an SSH bastion host in eight seconds using a toolkit built by hand, hitting a speed usually associated with AI-driven attacks. In a technical write-up published on September 11, Sysdig's Threat Research Team said the operator exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the Marimo notebook platform, and showed no sign of using a large language model (LLM) at any stage. A Human at Machine Speed CVE-2026-39987 affects Marimo up to and including 0.20.4 and is fixed in 0.23.0. The flaw is in the terminal WebSocket endpoint, which skipped the authentication check applied to the platform's other WebSocket endpoints, so any client that opened a connection to it got an interactive shell as the Marimo…