AI agents can hijack browser sessions by abusing hidden Windows internals

At a glance

What this is: WRAITHWATCH examines how frontier AI agents can pivot from a low-privilege shell to browser session hijacking by abusing Chromium debug transports and hidden Windows internals.

Why it matters: This matters because identity compromise can now emerge after initial access through agentic tool use, which pushes IAM, PAM, and endpoint teams to govern session exposure and replay paths as part of the attack surface.

Context

AI agents change the post-exploitation problem more than the initial-access problem. Once an attacker has a shell, the question is no longer whether they can find a bug, but whether they can navigate the operating system, browser session state, and identity material well enough to turn access into account takeover. In this article, the security gap is not detection of a classic payload, but governance over session tokens, browser debug transports, and the hidden runtime paths that let one process inherit another's authority.

Browser session hijacking is an identity security issue, not just an endpoint issue. When browser cookies or session artifacts can be replayed outside the original device context, MFA can be bypassed even when authentication itself was sound. That makes this a genuine IAM and NHI-adjacent problem because the attacker is abusing runtime trust, credential portability, and session persistence rather than stealing a password in the usual sense. The starting position described here is increasingly typical wherever workstation controls and identity controls are managed separately.

Key questions

Q: What fails when a stolen browser session can be replayed outside the original device?

A: MFA no longer protects the session once the browser cookie or token has already been issued. The failure is not in the login ceremony but in session portability, because the attacker can resume the authenticated context from another machine and inherit whatever the original session could do.

Q: Why do browser sessions create identity risk even when passwords are strong?

A: Browser sessions carry authenticated state such as cookies and tokens that can be replayed by an attacker after theft. Strong passwords do not help once the session has already been established, because the attacker can impersonate the user directly inside the browser context and reach business applications without reauthenticating.

Q: What are the signs that endpoint controls are missing agentic post-exploitation activity?

A: A common sign is that the same endpoint policy stops obvious command-line abuse but misses alternate process-launch paths, hidden runtime state, or tool-driven pivots into browser internals. When that happens, the attacker is adapting faster than the detection logic can follow.

Q: How should IAM and endpoint teams share responsibility for browser-session abuse?

A: IAM should own session binding, conditional access, and replay resistance, while endpoint teams own visibility into process startup, browser launches, and local token extraction paths. If either side works alone, the attack can move from local execution to account takeover without crossing a control boundary.

Technical breakdown

Why Chromium debug transports become a session-theft path

Chromium exposes debug transports that let a local process interact with the browser through the Chrome DevTools Protocol. In port mode, the transport uses a listener and WebSocket framing. In pipe mode, it uses anonymous pipes inherited from the parent process, which avoids the port-based detection logic many defenders rely on. If an attacker can launch or influence the browser process, they can extract session material directly from the running browser context without touching the application login flow. That turns the browser into an identity broker whose internals matter as much as the user interface.

Practical implication: Treat browser debug transports as a governed attack surface and disable them where they are not explicitly required.

How undocumented Windows startup internals enable handle inheritance

The Windows child-process model gives a parent process ways to pass handles, but the C runtime adds another layer: file descriptor initialization before main() runs. The article shows that lpReserved2 in STARTUPINFO can preload the runtime's file descriptor table, bridging Win32 handle inheritance and CRT expectations. That undocumented bridge matters because it lets an attacker map handles to the file descriptors that Chromium expects for pipe mode. Defenders who only watch documented API usage can miss the mechanism that actually makes the attack work.

Practical implication: Instrument process-creation telemetry deeply enough to inspect nonstandard startup data, not just command-line flags.

Why browser session replay defeats MFA after compromise

Once the attacker has valid session cookies, the browser session itself becomes the credential. Replaying cookies from another machine can resume an authenticated session without re-entering the primary factor, because MFA was already satisfied when the session was established. This is why pass-the-cookie attacks remain dangerous in modern identity environments: the control failure is not authentication strength at login, but the absence of tight session binding, device context enforcement, and replay detection at the token layer.

Practical implication: Bind sessions more tightly to device and risk signals so stolen cookies cannot be reused from a different execution environment.

Threat narrative

Attacker objective: Steal browser session material and replay it to bypass MFA, hijack the identity session, and gain full account access without triggering endpoint detection.

1. Entry begins with a low-privilege shell on a Windows Server endpoint, giving the agent enough local execution to inspect and control the browser process.
2. Credential access occurs when the agent uses Chromium debug transports and Windows startup internals to extract Entra session cookies from Edge.
3. Escalation follows when the stolen cookies are replayed from a different machine, bypassing MFA and converting session access into full Azure portal control.
4. Impact is browser-session hijacking with silent account takeover, while the tested EDR produced no alerts during the chain.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.
• EmeraldWhale Git config credential theft: Tokens in exposed .git/config files let EMERALDWHALE clone private repositories and steal more than 15,000 cloud credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Post-exploitation autonomy is now an identity risk category, not just a malware risk. The article shows that once an AI agent has a shell, it can reason through browser state, runtime internals, and session artifacts as a chain rather than as isolated steps. That shifts attention away from only blocking initial compromise and toward governing what a compromised workstation can do to identity material. For practitioners, the lesson is that session theft and replay must be treated as first-class identity events, not only endpoint anomalies.

lpReserved2 is a named concept for a deeper governance gap: undocumented startup state can carry security relevance that default controls never inspect. The attacker did not need a new privilege escalation bug; it needed a way to map inherited handles into the runtime model Chromium expected. That means defenders cannot assume documented process-creation telemetry is sufficient when agents or malware exploit internal initialization paths. Practitioners should treat hidden process-startup state as part of the control boundary, especially where browsers, runtimes, and identity tokens intersect.

Browser session portability is the real assumption this attack breaks. MFA policies often assume that once a session is issued, replay risk is secondary to login risk. The article shows the opposite: the dangerous step is not password entry, but the ability to move a valid session from one execution context to another. That is an NHI-adjacent governance problem because the token behaves like a portable machine credential once it leaves the user-device boundary. Security teams need to reduce trust in portable session artifacts, not just harden the authentication ceremony.

Endpoint detection tuned only to known command lines is too shallow for agentic tradecraft. The tested EDR missed both the debug-transport pivot and the low-level implementation path because the agent changed technique after the first block. That illustrates a broader pattern in agentic offense: the control failure is not lack of alerts for one string, but lack of visibility into the runtime decision path. Practitioners should expect AI-assisted attackers to search laterally across protocol layers, not just retry the same payload.

Identity governance must now extend into browser and workstation runtime behavior. If a browser session can be harvested locally and replayed externally, then IAM controls that stop at login are incomplete. The operational boundary has moved into token lifecycle, device context, and runtime observability. For identity teams, the practical conclusion is that browser session governance, conditional access, and NHI-style lifecycle thinking need to be aligned with endpoint detection and response.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Browser-session hijacking is becoming an identity governance problem, not just an endpoint detection problem. When a local shell can turn into a replayable browser session, the control boundary has already shifted from authentication to session lifecycle. Teams need to assume that any identity artifact held in the browser can become portable under post-exploitation conditions, which makes lifecycle visibility more important than login hardening alone.

Session portability is the new blast-radius issue. A stolen cookie is only useful if it can be replayed into meaningful privilege, so identity teams should map what each session can reach before compromise occurs. That is where conditional access, device context, and privilege scoping begin to matter together rather than as separate programmes.

Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That same visibility gap shows up here in a different form: if teams cannot see which sessions, tokens, and runtime paths exist on the endpoint, they will not see where browser identity can be hijacked until after the session is already gone.

For practitioners

• Disable Chromium remote debugging on managed endpoints Use device management policy to block both remote-debugging-port and remote-debugging-pipe unless there is a documented business need. This closes the transport the article used to extract session cookies.
• Inspect browser session replay exposure Review where session cookies can be reused outside the original device context and tighten conditional access so replayed tokens do not inherit full trust automatically.
• Harden process-creation telemetry Collect and review process creation data rich enough to spot nonstandard startup behavior, including hidden handle-passing mechanisms that basic command-line rules will miss.
• Treat browser sessions as identity assets Map which applications, groups, and administrative paths are reachable from a stolen browser session so you can reduce the blast radius before an attacker replays it.

Key takeaways

• AI-assisted post-exploitation changes the security problem from finding bugs to controlling what a local shell can do with identity material.
• The article shows that browser session replay can bypass MFA when session tokens are portable across devices and not tightly bound to context.
• Defence needs to move beyond login controls and command-line detection toward session governance, runtime visibility, and tighter token binding.

Key terms

• Browser Session Replay: Browser session replay is the reuse of a valid authenticated session from a different device or process. It bypasses the login ceremony by presenting already-issued session material, which makes the protection problem about token binding, context, and revocation rather than password strength alone.
• Chrome DevTools Protocol: Chrome DevTools Protocol is a management interface used to control Chromium-based applications at runtime over a debugging connection. It is intended for development and automation, but if exposed in production it can become a high-value control plane for changing application behaviour, state, or file handling.
• LpReserved2: lpReserved2 is an undocumented Windows startup field used by the C runtime during process initialization. In this article it acts as the bridge between inherited handles and runtime file descriptors, showing how hidden process-startup state can enable techniques that documented APIs do not reveal.
• Control Portability: Control portability is the ability of a governance control to keep working when the application architecture changes. In clean core programmes, portable controls survive release cycles, integrations, and cleanup of custom code, which makes them more reliable than controls that only exist inside legacy extensions.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to connect identity controls to the broader security programme.