AutoJack: How a single page can RCE the host running your AI agent

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted content and access local services, traditional boundaries like localhost are no longer secure. The post AutoJack: How a single page can RCE the host running your AI agent appeared first on Microsoft Security Blog .

In this article Why we are looking at agent frameworks What is AutoGen Studio The AutoJack chain at a glance Anatomy of the chain Issue 1: Origin allowlist that the agent itself defeats Issue 2: Auth middleware that opts MCP out Issue 3: server_paramsfrom the URL is the command line Putting it together: a realistic scenario Fixes and hardening measures applied Mitigation and protection guidance How Microsoft helps secure agentic systems Microsoft Defender detections What this means for the broader agent ecosystem Learn more Ongoing research into AI agent framework security identified an exploit chain in AutoGen Studio (AutoGen’s open-source prototyping user interface) that allows untrusted web content rendered by a browsing agent to reach a local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes on the host.