AutoJack RCE - CSWSH from Headless Browser to Localhost

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Detects headless browsers managed by AI agents making Cross-Site WebSocket Hijacking connections to localhost. Specifically, it looks for network connections initiated by processes with 'playwright' or 'MultimodalWebSurfer' in their command line, connecting to localhost (127.0.0.1 or ::1) on ports 8080 or 8081.