Vulnerabilities · 84 days ago
An AI agent that can browse untrusted pages and also reach localhost can turn a local control socket into a host-execution path. The standard trust split breaks here: the webpage is not just content, it becomes a delivery path into local tooling.
Microsoft’s AutoJack research shows that path in AutoGen Studio, where a malicious page could reach the MCP WebSocket and trigger arbitrary process execution on the host. The upstream fix landed in commit b047730, and the exposed surface was never shipped in PyPI, so the concern is concentrated in source and other non-release installs.
The same pattern applies anywhere an agent can browse the web and talk to local admin or tool endpoints. Once those two capabilities live in the same process, localhost stops being a safe boundary.
3 sources covering this story
Microsoft fixes AutoGen Studio flaw that enabled code execution
A vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system simply by visiting a malicious webpage.
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft details AutoJack exploit chain targeting AutoGen Studio MCP WebSocket in pre-release builds, enabling unauthenticated AI agent command execu
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine.
Part of the PlainSec briefing for 2026-06-22