AutoJack MCP WebSocket Command Injection via autogenstudio Child Process

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects suspicious child processes spawned from AutoGen Studio or mcp.py Python processes, which could indicate a WebSocket command injection vulnerability (AutoJack - CWE-78). The rule looks for common shell or command execution binaries and keywords in the process command line.