An AI agent that can browse untrusted pages and also reach localhost can turn a local control socket into a host-execution path. The standard trust split breaks here: the webpage is not just content, it becomes a delivery path into local tooling.
Microsoft’s AutoJack research shows that path in AutoGen Studio, where a malicious page could reach the MCP WebSocket and trigger arbitrary process execution on the host. The upstream fix landed in commit b047730, and the exposed surface was never shipped in PyPI, so the concern is concentrated in source and other non-release installs.
The same pattern applies anywhere an agent can browse the web and talk to local admin or tool endpoints. Once those two capabilities live in the same process, localhost stops being a safe boundary.