Threat · curated 28 Jun 2026
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
First reported microsoft.com
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
It demonstrates that an AI agent able to both browse untrusted pages and talk to privileged local services turns loopback into a remote-code-execution attack surface, a systemic risk for agent-framework developers.
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release.