Internal database exposure incident
Unnamed: organisation operating an exposed notebook and internal database · attacker-operated agent
- What happened
- Security firm Sysdig observed an attacker use an AI agent after compromising an exposed notebook. The operation moved through cloud credentials, a stored SSH key and a bastion host to copy out an internal PostgreSQL database.
- Impact
- The database schema and full contents were extracted in under two minutes (reported). The records involved and any later use were not reported.
- What would have caught it
- Limit notebook exposure and credential scope. Alert when newly used cloud keys lead to secret retrieval, bastion access and database exports.
- Sources
- Sysdig investigation and timeline (source date 2026-05-26)