AutoJack MCP WebSocket Session Token Theft via AutoGen Studio Agent

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.