AutoJack AutoGen Studio MCP Loopback Trust Abuse - Session Reuse via Headless Agent

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.