Threat
AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog
Publication date not yet evaluated · Added microsoft.com
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
It demonstrates that an AI agent able to both browse untrusted pages and talk to privileged local services turns loopback into a remote-code-execution attack surface, a systemic risk for agent-framework developers.
Microsoft researchers disclosed AutoJack, an exploit chain in AutoGen Studio where untrusted web content rendered by a browsing agent can reach a local MCP WebSocket and spawn arbitrary processes on the host, crossing the localhost trust boundary to achieve RCE. The issue was reported to MSRC and hardened upstream in commit b047730; the vulnerable MCP WebSocket surface was never shipped in a PyPI release.