On the morning of June 2, 2026, I ran my standard intelligence scan. Multiple AI-assisted searches across multiple platforms. The same queries I run every Tuesday and Thursday to build this brief.

The feed came back quiet. Vendor white papers. Analyst predictions. Framework documents. Month-old compilations repackaged as fresh insight. The Gartner Security & Risk Management Summit was running in Maryland. The coverage was conference panels and product announcements. Nothing raw. Nothing breaking.

My first instinct — trained by two years of pattern recognition in this space — was that the agentic threat landscape had gone calm.

It hadn’t.

On May 10, 2026, an unknown threat actor reached an internet-exposed Marimo notebook. One WebSocket request later, they had a shell.

What happened after the shell is what matters.

The attacker harvested cloud credentials from the host’s environment files and the AWS credentials store. Replayed them against AWS APIs. Retrieved an SSH private key from AWS Secrets Manager. Opened eight parallel SSH sessions against a downstream bastion server. Then dumped the schema and full contents of an internal PostgreSQL database — in under two minutes.

The entire chain, initial access to exfiltration, ran end-to-end in a little over an hour.

The post-exploitation wasn’t scripted. It was driven by an LLM agent. Sysdig’s Threat Research Team, which captured the intrusion, identified four tells: the attacker improvised a database dump with no prior knowledge of the schema, adapted commands to the environment in real time, fanned API calls across eleven distinct Cloudflare Workers IP addresses, and operated at a tempo no human keyboard produces — twelve AWS API calls distributed across those addresses in twenty-two seconds.

No. We are watching AI operate as one.

The agent didn’t break authentication. It inherited credentials and exercised authority that was never validated at the moment it acted. The lateral movement looked like legitimate credential use. The API calls routed through standard cloud infrastructure. The speed was the only anomaly — and speed alone isn’t something most detection stacks are built to flag.

The Marimo intrusion is arguably the most significant agentic-AI security event of the month. A real attack. A real database. A real LLM driving real lateral movement at machine speed, documented by a credible research team and published across multiple outlets.

To find it, you had to know to look for Sysdig.

It didn’t lead the security news cycle. Neither did any of the following — each a primary researcher disclosure from the past four weeks, each with direct implications for enterprises running AI coding tools and agentic infrastructure:

Every one of these disclosures was publicly indexed. None of them surfaced in a standard AI-assisted morning scan. The information was there. The window to it was not.

This isn’t suppression. It’s economics — which is harder to fix.

Search economics. Vendor content — white papers, prediction reports, framework documents — is professionally SEO-optimized, heavily backlinked, published on high-authority domains. Researcher disclosures live on smaller domains, are linked less, and are written for technical accuracy rather than search ranking. A generic query surfaces what’s been optimized for generic queries. The vendor narrative wins the feed. The researcher finding requires you to already know the researcher’s name.

AI access differentiation. Publishers and CDN providers increasingly serve different content to human browsers than to AI tools and automated scanners. Content that loads instantly for a person may be throttled, degraded, or blocked when an AI assistant requests it. This is documented behavior across bot-management layers, API-tier differentiation, and publisher-side AI blocking. The trend has accelerated sharply in 2026. A CISO who switched from reading security news directly to asking an AI to summarize it may not realize the summary is being drawn from a thinner pool than the web they used to browse.

The paywall ratchet. Premium threat intelligence has always been paid. What’s shifting is that the free tier — the open web, indexed search, AI-assisted scanning — is getting thinner. Not because less information exists, but because access to it increasingly requires paid feeds, authenticated crawling, or direct publisher subscriptions. The economics favor the vendor whitepaper over the researcher advisory. The vendor pays for distribution. The researcher pays for nothing.

The compound effect: the CISO running a morning scan sees calm. Not because the landscape is calm. Because the scan returns what has been optimized for the scan.

This compounds the problem NexusRiver has documented for thirty-one issues.

Blind spot one — internal. Organizations cannot see what their AI agents do at execution time. Authority is validated at authentication and never re-checked. Agents accumulate permissions, traverse systems, and execute commands within their authenticated scope with no runtime validation. The Marimo intrusion is the proof: an LLM agent exercising inherited credentials at machine speed, inside legitimate-looking API calls, leaving a trail built for human forensics and machine speed to outrun. Authenticated once ≠ authorized indefinitely. That is the authority gap.

Blind spot two — external. The tools CISOs use to monitor the threat landscape are returning a progressively degraded picture of it. The most important agentic intrusion of the month required knowing Sysdig’s name to find. The most significant coding-agent vulnerability of the month — six tools, one architectural flaw — required knowing Adversa AI’s name. The information exists. The window to it is narrowing.

The result is a leader operating with two blindfolds. You can’t see what your agents are doing inside the perimeter. You can’t reliably see what’s being done to them from outside it. And the instruments you’d use to close either gap are calibrated to show you the vendor-approved version of events.

Shadow AI incidents cost an average of $670,000 more than standard incidents — driven by delayed detection and difficulty scoping the exposure. 76% of organizations cite shadow AI as a growing problem. Malware in public model and code repositories is the most common breach source at 35%.

The MCPTox benchmark tested 45 live MCP servers and 353 authentic tools and found attack success rates above 60%, with the highest at 72%. The most capable models often performed worse — superior instruction-following made them more compliant with malicious metadata.

CrowdStrike 2026 Global Threat Report: 89% year-over-year rise in AI-enabled adversary activity. 82% of detections were malware-free. Kiteworks 2026: 63% of organizations cannot enforce purpose limits on their agents. 60% cannot terminate an agent that misbehaves.

High confidence. Low visibility. A shrinking window. And now: a thinner feed.

NexusRiver exists because this gap exists.

Every issue you receive is built from primary researcher sources, original CVE advisories, and direct intelligence — not from the filtered feed an AI assistant returns on a Tuesday morning. Not from the vendor-optimized version of the threat landscape. Not from the conference panel summary that displaced the intrusion report.

The threat landscape didn’t go quiet in late May. An AI agent dumped a production database in two minutes and most of the industry’s attention was somewhere else.

The question isn’t whether the incidents are happening. The Marimo chain, TrustFall, SymJack, three Semantic Kernel RCEs, and a DEF CON-demonstrated Copilot backdoor answer that decisively.

The question is whether you can still see them through the tools you trust.

And the honest answer, this month, is: only if you already know where to look.

That’s why you’re reading this.