AI agents can hijack browser sessions by abusing hidden Windows internals

At a glance

What this is: This is a technical analysis of how frontier AI agents were used to complete a browser-session hijack and MFA bypass by abusing Chromium debug transports and Windows process internals.

Why it matters: It matters because identity teams cannot rely on endpoint controls alone when session cookies, browser state, and hidden process mechanics can be chained into a full Entra compromise.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 47% have only partial visibility.

👉 Read WRAITHWATCH's analysis of AI-driven browser session hijacking and MFA bypass

Context

Frontier AI has been evaluated heavily on code generation and vulnerability discovery, but this article focuses on a harder problem: what happens after an attacker already has a shell. In that phase, the real attack surface includes browser sessions, identity tokens, process internals, and the control plane exposed by the endpoint itself, which is where Entra and other identity systems can be subverted.

The primary governance gap is not whether an endpoint can stop every payload, but whether the organisation can contain session theft once a credentialed browser context is reachable. That makes this a genuine identity-security issue, because session cookies, MFA bypass, and replayable browser state are all forms of identity abuse, even when the exploit path starts in Windows internals rather than IAM tooling.

Key questions

Q: What breaks when browser session cookies are treated as low-risk after MFA?

A: Security teams lose control of the authenticated session, not just the password. If an attacker can replay a valid cookie from another device, MFA no longer protects the session. The failure is assuming authentication time is the same as access time. Session lifetime, device binding, and revocation become the real control points.

Q: Why do browser session theft and cookie replay bypass strong identity controls?

A: Because many identity controls validate the login event, while the cookie represents the already-established session. If that session is copied intact, the attacker inherits the user’s authenticated context. The practical answer is to reduce token lifetime, add contextual revalidation, and revoke suspicious sessions as soon as device drift appears.

Q: What do security teams get wrong about endpoint controls and MFA?

A: They often assume EDR can catch the whole chain, but identity compromise can happen without malware, file drops, or obvious privilege escalation. In this pattern the decisive weakness is not missing MFA, it is over-trusting the browser session after MFA has already been satisfied.

Q: Who is accountable when a valid session token is replayed?

A: Accountability usually spans IAM, endpoint, and cloud platform owners because replay indicates a control gap across session governance, device context, and authentication policy. The key question is whether the organisation had explicit controls for token binding, reauthentication, and legacy-auth removal. If not, the failure is architectural, not just operational.

Technical breakdown

Chromium remote debugging creates a credential theft path

Chromium-based browsers expose two debug transports: a TCP port mode and a pipe mode. Both can provide programmatic access to browser state, including cookies, session material, and page context. In the article’s attack path, the AI agent used debug transport to reach cleartext browser secrets after replacing the Edge shortcut and relaunching the browser under controlled conditions. That matters because cookie theft is not a traditional exploit chain in the sense of memory corruption or kernel compromise. It is a post-exploitation path that converts browser trust into identity compromise.

Practical implication: block or tightly govern browser debug transports on managed endpoints, especially where session cookies can be replayed into identity portals.

lpReserved2 bridges Win32 handles and CRT file descriptors

On Windows, inheritable handles are not the same thing as C runtime file descriptors. The article shows why that distinction matters: Chromium’s pipe mode expects file descriptors 3 and 4 to exist before main() runs, and documented handle inheritance alone does not create them. The undocumented STARTUPINFO.lpReserved2 field lets the C runtime pre-populate its descriptor table during process startup. That is a subtle but important boundary, because a control that only watches Win32 handle inheritance can miss a working CRT-level file descriptor injection path entirely.

Practical implication: inspect process creation and runtime inheritance paths, not just obvious API calls, when hunting for stealthy credential-extraction tooling.

Pass-the-cookie bypasses MFA without breaking the factor itself

The end state is not password theft but session replay. Once the agent extracted Edge cookies, it could replay them from another system and hijack the Azure portal session without needing the user’s MFA challenge again. That is why cookie theft remains so dangerous: many identity controls are enforced at authentication time, while session state persists afterward. If the session token is valid, the attacker may inherit the already-authenticated context even when MFA was originally strong.

Practical implication: treat session tokens as high-value secrets and pair MFA with conditional access, device binding, and rapid session revocation.

Threat narrative

Attacker objective: The objective is to hijack an authenticated cloud session and bypass MFA by replaying stolen browser cookies from a compromised endpoint.

1. Entry occurred when the attacker or agent obtained a low-privilege shell on a Windows Server 2022 host and then steered browser relaunch behaviour toward debug-enabled execution.
2. Credential access followed when the agent used Chromium debug transports and Windows runtime internals to extract browser cookies and session material from Edge.
3. Escalation happened when the stolen session cookies were replayed into the Azure portal, bypassing Entra MFA and inheriting authenticated access.
4. Impact was full session hijack with no EDR alert on the tested configuration, showing that identity compromise can succeed after endpoint compromise without a noisy malware phase.

NHI Mgmt Group analysis

Post-exploitation autonomy is the more urgent AI security problem than initial access. The article shows that frontier models can already chain reconnaissance, browser manipulation, and identity abuse once a shell exists. That shifts defensive emphasis away from benchmarked bug discovery and toward blast-radius control, session containment, and runtime detection across identity-bearing workflows. Practitioners should treat AI-enabled post-exploitation as a governance problem, not only a malware problem.

Session replay is now a first-class identity attack path, not a secondary abuse case. The compromise worked because browser cookies and authenticated sessions were treated as durable trust artefacts after MFA had already been satisfied. That failure mode sits at the intersection of IAM, PAM, and NHI governance, because access decisions made at login do not protect the session afterwards. The control gap is standing session trust, and practitioners should govern it as aggressively as passwords or API keys.

Chromium debug transports expose a hidden identity-security boundary. The article’s most interesting technical point is not the tool choice but the use of browser internals to reach identity material without tripping default endpoint controls. That is a named concept worth tracking: browser-to-identity escalation, where a local process path becomes a cloud identity compromise. Security teams should assume browser state can be weaponised into access, then build controls around that boundary.

Undocumented runtime mechanisms create detection blind spots that conventional EDR rules will miss. lpReserved2 is a good example of a control gap that sits below normal process command-line inspection. If defenders only validate obvious flags, they will miss tools that shift the attack into runtime inheritance or hidden startup state. The practical conclusion is that identity compromise prevention must extend into endpoint telemetry, not stop at the IAM boundary.

Agentic systems need governance over objective framing, not only tool permissions. The article shows that one agent solved the wrong problem while a second agent reframed the task and found the working path. That is a broader governance lesson for AI security: the risk is not only what tools an agent can call, but how it is allowed to reframe problems and pursue alternate execution layers. Practitioners should govern agent objectives, escalation limits, and session effects together.

What this signals

Browser-session hijacking is becoming an identity governance problem because the attack surface now includes the runtime state of authenticated sessions, not just credential issuance. Teams should connect endpoint telemetry, conditional access, and session revocation workflows so a browser-level anomaly can trigger identity containment before the attacker reuses the cookie.

Browser-to-identity escalation: when a local process path is used to extract session state and convert it into cloud access, the endpoint becomes an identity attack vector. That boundary deserves explicit policy, telemetry, and revocation design, especially where Entra, SSO, or other federated sessions persist beyond initial authentication.

For practitioners

• Disable browser debug transports on managed endpoints Use device policy to block Chromium-based remote debugging where it is not explicitly required, and validate that both port and pipe modes are prevented on the estate. This removes the specific browser control plane used in the attack chain and reduces the chance of cookie extraction from user sessions.
• Treat session cookies as privileged identity secrets Classify session tokens alongside passwords and API keys in your NHI and identity governance model, then shorten session lifetime where business workflows allow it. Add explicit revocation and reauthentication triggers for suspicious device changes, browser relaunch anomalies, and impossible travel.
• Correlate endpoint telemetry with identity events Join process creation, browser launch, and authentication logs so a local debug transport change can be evaluated against Entra or SSO session behaviour. That correlation is necessary when the attack path starts on the endpoint but finishes in the identity layer.
• Test for replayable browser state in red-team exercises Include cookie replay and MFA bypass simulations in exercises that currently focus only on malware or credential phishing. Use the findings to map which applications trust session state too long and which conditional access policies fail to re-check device posture.

Key takeaways

• AI agents can already assist with post-exploitation identity abuse, which makes browser sessions and cloud tokens a higher-priority control surface than many teams assume.
• The tested attack succeeded by combining Chromium debug transport abuse with hidden Windows runtime behaviour, showing how default endpoint controls can miss the path from shell to session hijack.
• Defenders should harden browser transports, shorten session trust windows, and correlate endpoint and identity telemetry so replayable cookies do not become silent account takeover events.

Key terms

• Browser-to-Identity Escalation: A browser-to-identity escalation occurs when local browser state, session material, or debug access is turned into authenticated cloud access. The user’s identity is not broken at login, but the attacker inherits it through replayable session artefacts and trust that persists after authentication.
• Session Replay: A technique where an attacker reuses a captured authenticated session token to act as the victim without knowing the password. In modern cloud environments, replay can bypass traditional login controls and persist until the token is revoked or naturally expires.
• Post-Exploitation Autonomy: Post-exploitation autonomy is the ability of an AI system to carry out meaningful attacker work after initial access has already been achieved. It includes reconnaissance, tool selection, process manipulation, and identity abuse, which shifts the risk from code discovery to live operational compromise.

What's in the full report

WRAITHWATCH's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact PowerShell and C# in-memory build chain used to launch Edge with remote debugging.
• The lpReserved2 blob construction details that bridge handle inheritance to CRT file descriptors.
• The full attack-chain timings, model-by-model results, and EDR behaviour table.
• The specific browser and Windows internals references used to validate the pipe-mode technique.

👉 The full WRAITHWATCH post covers the attack chain, Windows internals, and EDR evasion details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the context of enterprise access risk. It is designed for practitioners who need to connect identity controls to operational security outcomes across modern environments.