AutoJack RCE - Malicious MCP WebSocket Connection

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•9

Detects WebSocket connections to the AutoGen Studio MCP control plane on ports 8080 or 8081, specifically looking for URLs containing '/api/mcp/ws/' and 'server_params=', which may indicate an attempt at Remote Code Execution (RCE) via malicious server parameters.