Hackers Use LLM Agent to Pivot From marimo RCE to Internal Database