Summary
Microsoft researchers have disclosed “AutoJack,” an exploit chain that allows a single malicious webpage to hijack an AI browsing agent and achieve full remote code execution on the host machine. The vulnerability, found in AutoGen Studio — Microsoft Research’s open-source prototyping interface for multi-agent AI frameworks — was patched on June 18, 2026.
The attack exploits three weaknesses in AutoGen Studio’s Model Context Protocol (MCP) WebSocket implementation: implicit trust of localhost connections, missing authentication, and unsafe parameter handling. When an AI agent navigates to a crafted webpage, JavaScript on the page connects to the privileged local MCP service and executes arbitrary commands on the developer’s machine — no credentials or further interaction required.
Microsoft confirmed that the vulnerability was identified during development and was only present in two pre-release builds (0.4.3.dev1 and 0.4.3.dev2), not in any stable PyPI release. No exploitation in the wild has been reported.
Sources
- Microsoft Security Blog — AutoJack: single-page RCE on host running AI agent
- The Hacker News — AutoJack attack lets one web page hijack AI agent
- CSO Online — Web-enabled AI agents can trigger host-level RCE
Commentary
AutoJack is a textbook example of the emerging attack surface that AI agents are creating. The fundamental issue isn’t specific to AutoGen Studio — it’s the broader pattern of AI agents that browse untrusted content while maintaining privileged access to local services. When an agent can both visit arbitrary URLs and execute commands via localhost, the traditional browser security boundary evaporates entirely.
This is the kind of research that should be mandatory reading for anyone building or deploying AI agent frameworks. The key takeaways are clear: localhost is not a security boundary when agents are in the loop, MCP endpoints need authentication regardless of bind address, and dangerous actions like process execution must be explicitly allowlisted. Expect this class of vulnerability to multiply as agentic AI goes mainstream — the industry is racing to ship agents without fully understanding the trust boundaries they’re demolishing.