Notifications
Clear all
Topic starter
18/08/2026 2:12 pm
TL;DR: Frontier models running with only a low-privilege shell were able to bypass Entra MFA by stealing and replaying Edge session cookies through Chromium debug transports, including an undocumented Windows startup mechanism, without triggering the tested EDR, according to WRAITHWATCH. The finding shows that post-exploitation autonomy now matters as much as initial access, because identity compromise can emerge from agentic tool use rather than classic malware tradecraft.
NHIMG editorial — based on content published by WRAITHWATCH: LLMjacking and browser-session hijacking through compromised NHIs
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 47% have only partial visibility.
Questions worth separating out
Q: What breaks when browser session cookies are treated as low-risk after MFA?
A: Security teams lose control of the authenticated session, not just the password.
Q: Why do browser session theft and cookie replay bypass strong identity controls?
A: Because many identity controls validate the login event, while the cookie represents the already-established session.
Q: What do security teams get wrong about endpoint controls and MFA?
A: They often assume EDR can catch the whole chain, but identity compromise can happen without malware, file drops, or obvious privilege escalation.
Practitioner guidance
- Disable browser debug transports on managed endpoints Use device policy to block Chromium-based remote debugging where it is not explicitly required, and validate that both port and pipe modes are prevented on the estate.
- Treat session cookies as privileged identity secrets Classify session tokens alongside passwords and API keys in your NHI and identity governance model, then shorten session lifetime where business workflows allow it.
- Correlate endpoint telemetry with identity events Join process creation, browser launch, and authentication logs so a local debug transport change can be evaluated against Entra or SSO session behaviour.
What's in the full report
WRAITHWATCH's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact PowerShell and C# in-memory build chain used to launch Edge with remote debugging.
- The lpReserved2 blob construction details that bridge handle inheritance to CRT file descriptors.
- The full attack-chain timings, model-by-model results, and EDR behaviour table.
- The specific browser and Windows internals references used to validate the pipe-mode technique.
👉 Read WRAITHWATCH's analysis of AI-driven browser session hijacking and MFA bypass →
Browser session hijacking through AI agents: are your controls keeping up?
Explore further
18/08/2026 3:04 pm
Post-exploitation autonomy is the more urgent AI security problem than initial access. The article shows that frontier models can already chain reconnaissance, browser manipulation, and identity abuse once a shell exists. That shifts defensive emphasis away from benchmarked bug discovery and toward blast-radius control, session containment, and runtime detection across identity-bearing workflows. Practitioners should treat AI-enabled post-exploitation as a governance problem, not only a malware problem.
A question worth separating out:
Q: Who is accountable when a valid session token is replayed?
A: Accountability usually spans IAM, endpoint, and cloud platform owners because replay indicates a control gap across session governance, device context, and authentication policy. The key question is whether the organisation had explicit controls for token binding, reauthentication, and legacy-auth removal. If not, the failure is architectural, not just operational.
👉 Read our full editorial: AI agents can hijack browser sessions by abusing hidden Windows internals
