Bring Your Own Agent: Detecting and Containing Unmanaged AI Agents (Meta Muse, Instinct) in Your Enterprise

---
title: Browser Automation Framework Execution on Endpoint
id: 8b2c4d61-3f5a-4e7b-9c1d-2a6f8e0b4d31
status: experimental
description: Detects execution of browser automation frameworks (Playwright, Puppeteer, Selenium, ChromeDriver) commonly used by personal AI agents to drive authenticated browsing sessions.
references:
  - https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/28
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\chromedriver.exe'
      - '\msedgedriver.exe'
      - '\geckodriver.exe'
  selection_cli:
    CommandLine|contains:
      - 'playwright'
      - 'puppeteer'
      - 'selenium-webdriver'
      - '--remote-debugging-port'
      - '--headless'
      - '--disable-blink-features=AutomationControlled'
  condition: selection_image or selection_cli
falsepositives:
  - QA and development teams running sanctioned browser automation
  - RPA platforms deployed by IT
level: medium
---
title: Non-Browser Process Connecting to LLM API Endpoints
id: 3d7f9a24-6c1e-4b8d-a5f2-9e0c7b3d5a82
status: experimental
description: Detects network connections from non-browser processes to known LLM/agent API endpoints, indicating a desktop AI agent or script egressing data outside the managed browser.
references:
  - https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/10/28
tags:
  - attack.exfiltration
  - attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'openai.azure.com'
      - 'ai.meta.com'
      - 'claude.ai'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  filter_sanctioned:
    Image|contains:
      - 'C:\Program Files\ApprovedAIClient\'
  condition: selection_dest and not filter_browsers and not filter_sanctioned
falsepositives:
  - Sanctioned AI desktop clients (update filter_sanctioned accordingly)
  - Developer tooling and SDKs — investigate by user and process lineage
level: high

// Hunt: Non-browser processes communicating with LLM/agent API endpoints
// Indicates unmanaged desktop agents or scripts egressing corporate data
let llm_domains = dynamic(["api.openai.com", "api.anthropic.com", "generativelanguage.googleapis.com", "claude.ai", "ai.meta.com", "chatgpt.com"]);
let browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "safari"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (llm_domains)
| where InitiatingProcessFileName !in~ (browsers)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), DistinctDestinations = dcount(RemoteUrl)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by Connections desc
;
// Hunt: Browser launched with automation/remote debugging flags (agent-driven browsing)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where ProcessCommandLine has_any ("--remote-debugging-port", "--headless", "--disable-blink-features=AutomationControlled")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc
;
// Hunt: OAuth grants to unapproved third-party apps (agent SaaS connections) — requires M365 audit ingestion
// CloudAppEvents
// | where ActionType == "Consent to application."
// | where ApplicationDisplayName !in ("<your approved app list>")
// | project TimeGenerated, AccountDisplayName, ApplicationDisplayName, IPAddress, RawEventData

-- Hunt for unmanaged AI agent indicators: automation processes, headless browsers,
-- and live connections to LLM API endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(playwright|puppeteer|selenium|--remote-debugging-port|--headless|chromedriver)'
   OR Name =~ '(?i)(muse|instinct|agent)'

-- Correlate active connections to LLM endpoints with owning process
SELECT netstat.Pid, netstat.Name AS ProcessName, netstat.RaddrIP, netstat.Rport,
       netstat.Status, pslist.CommandLine, pslist.Username
FROM netstat()
JOIN pslist() ON netstat.Pid = pslist.Pid
WHERE netstat.Rport = 443
  AND pslist.Name !~ '(?i)(chrome|msedge|firefox|brave|svchost)'
  AND pslist.CommandLine =~ '(?i)(openai|anthropic|claude|gemini|llm|agent)'

# Audit and harden endpoints against unmanaged AI agent usage
# Run as Administrator; review output before applying any blocks

$report = @()

# 1. Enumerate running automation frameworks and agent-like processes
$agentProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.CommandLine -match 'playwright|puppeteer|selenium|--remote-debugging-port|chromedriver' -or
    $_.Name -match 'muse|instinct'
}
$report += $agentProcs | Select-Object Name, ProcessId, CommandLine

# 2. Check for automation Python packages installed outside managed environments
$pyPkgs = @()
Get-Command python, pip -ErrorAction SilentlyContinue | ForEach-Object {
    $pyPkgs += & pip list 2>$null | Select-String -Pattern 'playwright|selenium|pyautogui|browser-use|openai|anthropic'
}
$report += $pyPkgs

# 3. Enumerate Chromium/Edge extensions with broad host permissions (agent extensions)
$extPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions",
              "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions")
foreach ($base in $extPaths) {
    if (Test-Path $base) {
        Get-ChildItem $base -Recurse -Filter manifest.json -ErrorAction SilentlyContinue | ForEach-Object {
            $m = Get-Content $_.FullName -Raw | ConvertFrom-Json
            if (($m.permissions -match 'cookies|webRequest|tabs|<all_urls>') -and ($m.name -notmatch 'Google|Microsoft')) {
                $report += [PSCustomObject]@{ Name = $m.name; ProcessId = 'extension'; CommandLine = $_.FullName }
            }
        }
    }
}

$report | Format-List
$report | Export-Csv -Path ".\AI-Agent-Audit-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# 4. OPTIONAL hardening: block outbound LLM API access from non-browser processes
# Uncomment after review; coordinate with your DLP/proxy strategy first
# $llmHosts = @('api.openai.com','api.anthropic.com','generativelanguage.googleapis.com')
# foreach ($h in $llmHosts) {
#     New-NetFirewallRule -DisplayName "Block Unmanaged LLM Egress - $h" `
#         -Direction Outbound -Action Block -RemoteAddress (Resolve-DnsName $h).IPAddress `
#         -Program "*" -ErrorAction SilentlyContinue
# }

# 5. Enforce extension allowlisting via policy (Chrome example) — deploy via GPO/Intune
# Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist' -Name '1' -Value '*'
# Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist' -Name '1' -Value '<approved-extension-id>'