Artificial intelligence is often seen as a game-changer in cybersecurity, but recent findings from Sysdig reveal that skilled human attackers can operate with remarkable speed and precision. A threat actor recently demonstrated this by exploiting a vulnerability in Marimo notebooks and reaching an SSH bastion host in just eight seconds. This feat was accomplished using a custom Python toolkit written manually, without any assistance from AI. Sysdig's Threat Research Team noted that the speed of this attack is typically associated with AI-assisted operations, yet it was achieved purely through human ingenuity. The attack exploited CVE-2026-39987, a serious remote code execution vulnerability with a CVSS score of 9.3. This vulnerability was actively exploited within hours of its public disclosure. Once initial access was gained, the attacker executed a complex credential-pivot chain involving the Marimo flaw to obtain a full interactive shell. This was followed by a call to Amazon Web Services Secrets Manager using credentials harvested from the compromised instance, allowing SSH access to a bastion host. Over a nine-hour period, the attacker issued more than 850 interactive commands, relying solely on self-developed scripts rather than publicly available offensive tools. The operation highlighted the ability of skilled attackers to not only move at machine speed but also evade detection by defenders more effectively than automated systems might. The implications of these findings are significant, particularly as AI continues to change the dynamics of cyberattacks by enabling faster time-to-exploit and reducing manual effort. However, the value of human expertise in crafting bespoke attacks remains clear. In parallel, Hunt.io reported a cryptomining campaign targeting Redis servers through broad internet scans. This campaign exploited the SLAVEOF command to deploy an XMRig miner, showcasing another facet of the evolving threat landscape.