AutoJack: AutoGen Studio MCP WebSocket RCE - Shell Spawned by Agent Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule detects the spawning of common command-line interpreters, utilities, and scripting engines by a parent process associated with 'autogenstudio'. This behavior is potentially indicative of command injection or exploitation where an AI-driven development environment is leveraged to execute unauthorized system commands or launch malicious payloads.