AutoJack: AI Browsing Agent Becomes Local RCE Vehicle

Microsoft researchers have published an exploit chain called AutoJack that turns an AI browsing agent into a remote code execution vehicle. The setup is almost embarrassingly tidy. Point the agent at a malicious web page, let the page's JavaScript talk to a privileged local service on the same machine, and the attacker gets to spawn a process on the host. No credentials, no prompts, no further clicks.

Where the bug lives

The flaw sits in AutoGen Studio, the open-source prototyping interface for Microsoft Research's AutoGen multi-agent framework. The current stable PyPI release, 0.4.2.2, is unaffected because it has no Model Context Protocol route at all. But two pre-release builds, 0.4.3.dev1 and 0.4.3.dev2, shipped the vulnerable MCP WebSocket handler. Pip will not pull those unless you ask for them with --pre or pin the version, but anyone who did is exposed. Neither build has been yanked.

Three reasonable assumptions, one nasty chain

The attack leans on three small assumptions, each defensible on its own:

• The socket trusted localhost, on the basis that a normal browser pointed at a malicious site would not qualify.
• The authentication middleware skipped MCP paths, assuming the handler would check tokens itself.
• The handler did no such thing, and it happily took the command to run straight from the request, with no allowlist on the executable.

A browsing agent on the same box is localhost, so anything it loads inherits that identity. Microsoft's proof of concept fed a Web Content Summarizer agent an attacker URL and popped calc.exe on the developer's desktop.

What the maintainers did

The main branch has been hardened in commit b047730. Command parameters are now stored server-side behind a one-time session ID, and MCP routes run through the normal authentication path. That fix is not in a PyPI release yet, so if you are on one of the dev builds, pull from GitHub main rather than waiting.

Until then, do not run AutoGen Studio on the same machine as a browsing or code-execution agent that touches untrusted content. If they must coexist, separate them into containers or VMs and run AutoGen Studio under a low-privilege account.

The pattern is the point

Microsoft is candid that the pattern matters more than this particular bug. The same shape, a local service with too much power, a localhost check mistaken for a security boundary, an agent that wanders the open web, is showing up elsewhere. ChatGPhish used page summaries as a phishing vector last month. Semantic Kernel had its own localhost RCE research. Once an agent can browse anywhere and reach privileged local services, localhost is just an address, not a trust boundary.