inject_browserpivotStart

What inject_browserpivotStart does on Cobalt Strike MCP Server

AI agents invoke inject_browserpivotStart to trigger actions in Cobalt Strike MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why inject_browserpivotStart is rated High

Browser pivot injection executes code within a target process (browser) to establish a foothold for further attacks, lateral movement, and command execution. This is a remote code execution primitive with high blast radius—an AI agent invoking this could compromise user systems, establish persistence, or pivot to other hosts.

From the tool's definition Tool name 'inject_browserpivotStart' indicates injection and pivoting operations; server description explicitly mentions 'beacon control' and 'payload generation' for red team operations; browser pivot is a Cobalt Strike feature that executes arbitrary code…

The rule that runs inject_browserpivotStart safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Cobalt Strike MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For inject_browserpivotStart, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "inject_browserpivotStart": {
      "limits": [
        {
          "counter": "inject_browserpivotstart_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about inject_browserpivotStart