Microsoft researchers have disclosed a new exploit chain called AutoJack that can transform an AI-powered browsing agent into a vehicle for remote code execution (RCE).
The attack requires only one action from the victim: getting the AI agent to load a malicious web page. Once the page is opened, attacker-controlled JavaScript can communicate with a privileged local service running on the same machine and execute arbitrary commands on the host system.
Notably, the attack does not require user credentials, authentication prompts, or additional user interaction. A malicious URL embedded in a prompt, link, or form field is enough to trigger the chain.
The Vulnerability Targets AutoGen Studio
The issue affects AutoGen Studio, the open-source prototyping interface for Microsoft’s AutoGen multi-agent framework.
However, the impact depends heavily on which version is installed.
The current stable release available through PyPI, AutoGen Studio 0.4.2.2, does not contain the vulnerable Model Context Protocol (MCP) functionality. This supports Microsoft’s statement that the vulnerable MCP WebSocket interface “was never included in a PyPI release”—at least for stable versions.
The situation is different for two pre-release builds:
- AutoGen Studio 0.4.3.dev1
- AutoGen Studio 0.4.3.dev2
Security researchers verified that both development versions contain the vulnerable MCP WebSocket handler. The endpoint accepts commands directly from incoming requests and does not require authentication.
Although pip does not install pre-release packages by default, users who explicitly installed these versions using --pre or version pinning may be exposed. At the time of writing, neither package has been removed from PyPI.
How the AutoJack Attack Works
AutoJack combines three separate weaknesses within the MCP WebSocket implementation.
1. Localhost Trust Assumption
The WebSocket service trusted requests originating from localhost, a security measure intended to block access from malicious websites.
However, AI browsing agents running on the same machine also appear as localhost. As a result, any malicious webpage loaded by the agent inherits that trusted status and bypasses the restriction.
2. Missing Authentication
The authentication middleware excluded MCP routes because developers assumed the handler would perform its own token verification.
That verification never occurred.
As a result, attackers could establish WebSocket connections without authentication, regardless of the configured security settings.
3. Unsafe Command Execution
The endpoint accepted a command directly from a request parameter and executed it without validation or restrictions.
No allowlist controlled which applications could be launched, giving attackers the ability to run arbitrary executables on the host machine.
From Web Page to Remote Code Execution
By chaining these weaknesses together, a malicious website viewed through a local AI browsing agent can execute attacker-controlled commands under the same user account running AutoGen Studio.
Microsoft emphasized that this finding emerged from internal security research and that there is currently no evidence of active exploitation in the wild.
In the proof-of-concept demonstration, researchers used a “Web Content Summarizer” agent. When directed to an attacker-controlled URL, the malicious page successfully launched calc.exe on the developer’s machine through the AutoGen Studio process.
Patch Available in Source Code
Microsoft reported the issue through the Microsoft Security Response Center, and maintainers implemented fixes in the project’s GitHub repository through commit b047730 (PR #7362).
The updated implementation introduces several important protections:
- Commands are no longer read directly from URL parameters.
- Execution parameters are stored server-side.
- Requests must reference a one-time session identifier.
- Invalid session IDs are rejected.
- MCP endpoints now pass through the standard authentication pipeline.
While the fixes are available in the GitHub source code, they have not yet been included in an official PyPI release.
Who Is Affected?
Not Affected
Users running a standard installation:
pip install autogenstudio
will receive version 0.4.2.2, which does not include the vulnerable MCP functionality.
Potentially Affected
Users who installed the following development releases may be vulnerable:
- 0.4.3.dev1
- 0.4.3.dev2
For these environments, the recommended solution is to update directly from the GitHub repository using code that includes commit b047730 or later.
Recommended Mitigations
Until an updated PyPI package becomes available, organizations should reduce exposure by separating components involved in the attack chain.
Security experts recommend:
- Avoid running AutoGen Studio on the same machine as AI browsing agents that access untrusted content.
- Use separate containers or virtual machines for AI agents and AutoGen Studio.
- Run AutoGen Studio under a low-privilege account.
- Restrict process execution through allowlists.
- Enforce strong authentication for all local control-plane services.
A Broader Security Warning for AI Agent Frameworks
According to Microsoft, AutoJack highlights a broader architectural problem affecting AI agent ecosystems.
The dangerous combination typically involves:
- A privileged local service.
- Overreliance on localhost as a security boundary.
- AI agents capable of browsing untrusted websites.
Researchers warn that localhost should no longer be considered a trusted security boundary when autonomous agents can freely access web content while interacting with local services.
Microsoft notes that similar issues have appeared in previous research, including ChatGPT-related phishing techniques and remote code execution vulnerabilities identified in Semantic Kernel.
Key Takeaway
As AI agents gain more autonomy and local system access, traditional trust assumptions become increasingly risky. Organizations should authenticate local services, restrict command execution, and isolate AI agents from sensitive environments.
In the era of AI-powered automation, simply trusting localhost is no longer enough.
