Microsoft researchers have disclosed a novel attack technique called AutoJack that enables host-level remote code execution through web-enabled AI agents. The attack chains three weaknesses in AutoGen Studio's MCP WebSocket implementation: a localhost origin check that browsing agents can satisfy by inheritance, unenforced authentication on MCP WebSocket paths, and an unvalidated URL parameter that passes arbitrary commands directly to the process-spawning mechanism. A malicious webpage rendered by the agent can exploit all three flaws without additional user interaction to execute arbitrary processes like PowerShell or Bash on the host. The vulnerable code never reached a public PyPI release and has since been patched, but Microsoft warns the underlying pattern — agents with local access browsing the open web — affects a broader class of agentic frameworks beyond AutoGen.
