--- title: Microsoft says web-enabled AI agents can trigger... description: Microsoft researchers have disclosed a novel attack technique called AutoJack that enables host-level remote code execution through web-enabled AI agents. The... canonical: https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft says web-enabled AI agents can trigger host-level RCE | daily.dev og:description: Microsoft researchers have disclosed a novel attack technique called AutoJack that enables host-level remote code execution through web-enabled AI agents. The... og:url: https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg og:image: https://api.daily.dev/og/posts/ggdk1YjSg.png og:image:alt: Microsoft says web-enabled AI agents can trigger host-level RCE og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft says web-enabled AI agents can trigger host-level RCE **[CSO Online](https://daily.dev/sources/csoonline)** · 3 min read · 0 upvotes · 0 comments ## Summary Microsoft researchers have disclosed a novel attack technique called AutoJack that enables host-level remote code execution through web-enabled AI agents. The attack chains three weaknesses in AutoGen Studio's MCP WebSocket implementation: a localhost origin check that browsing agents can satisfy by inheritance, unenforced authentication on MCP WebSocket paths, and an unvalidated URL parameter that passes arbitrary commands directly to the process-spawning mechanism. A malicious webpage rendered by the agent can exploit all three flaws without additional user interaction to execute arbitrary processes like PowerShell or Bash on the host. The vulnerable code never reached a public PyPI release and has since been patched, but Microsoft warns the underlying pattern — agents with local access browsing the open web — affects a broader class of agentic frameworks beyond AutoGen. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Microsoft fixes AutoGen Studio flaw that enabled code execution](https://daily.dev/posts/microsoft-fixes-autogen-studio-flaw-that-enabled-code-execution-ux7o821d6) · BleepingComputer · 0 upvotes · 0 comments - [This AI agent autonomously hacked a network, adapted on the fly, and demanded a ransom](https://daily.dev/posts/this-ai-agent-autonomously-hacked-a-network-adapted-on-the-fly-and-demanded-a-ransom-u3norexvg) · CSO Online · 0 upvotes · 0 comments - [Latest OpenClaw Flaw Can Let Malicious Websites Hijack Local AI Agents](https://daily.dev/posts/latest-openclaw-flaw-can-let-malicious-websites-hijack-local-ai-agents-ypkd31d1j) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft says web-enabled AI agents can trigger host-level RCE","url":"https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg"},"datePublished":"2026-06-19T08:45:22.800Z","dateModified":"2026-08-24T07:10:52.744Z","description":"Microsoft researchers have disclosed a novel attack technique called AutoJack that enables host-level remote code execution through web-enabled AI agents. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e881354aa4319c189b94a45bd52498e2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e881354aa4319c189b94a45bd52498e2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-says-web-enabled-ai-agents-can-trigger-host-level-rce-ggdk1yjsg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,prompt-injection","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Microsoft says web-enabled AI agents can trigger host-level RCE"}]} ```