AutoJack Exploits Browsing Agents to Achieve RCE

Microsoft's Defender Security Research Team disclosed AutoJack on June 18, 2026 via the Microsoft Security Blog - a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a host-level remote code execution (RCE) vector. The chain combines attacker-controlled web content, implicit trust in localhost, missing authentication on local endpoints, and unsafe parameter handling to reach AutoGen Studio's MCP WebSocket, enabling arbitrary process execution on the host. According to Microsoft, the affected MCP WebSocket surface was never included in a PyPI release; users who install AutoGen Studio from PyPI are not exposed to this specific chain.

Microsoft's research identifies three chained weaknesses in AutoGen Studio's MCP WebSocket: unauthenticated local WebSocket endpoints, insecure URL-based parameter passing that reaches shell-invokable code paths, and a browsing agent that follows untrusted page-hosted content. No proof-of-concept code was published. For source-based installs, maintainers have since removed URL-based parameter injection, routed MCP paths through normal authentication flows, and implemented server-side parameter handling keyed to session identifiers, per Microsoft's disclosure. Microsoft's May 2026 security blog ("When prompts become shells") separately documented RCE paths in Semantic Kernel via prompt injection to code/eval sinks - the same attack class applies across agent frameworks.

The broader attack class - malicious web content reaching local services through a browsing agent - was documented as early as February 2026 with ClawJacked (OpenClaw) and in subsequent disclosures involving MCP-based runtimes. AutoJack follows the same pattern: a browser permits a WebSocket connection to localhost, the AI agent follows the page, and the attacker uses the open connection to reach an unprotected local service. As a first-party Microsoft Security disclosure, the findings are confirmed; the limited exposure (PyPI users unaffected, source installs patched) constrains operational impact but the research contribution is significant.

For source-install users of AutoGen Studio, apply the maintainer patches described by Microsoft: authentication on MCP paths and server-side parameter handling. Monitor for any CVE assignment tied to the MCP WebSocket interface. Practitioners should also watch for similar disclosures across other MCP-based agent runtimes that expose local WebSocket or REST interfaces to browsing agents.

Audit local interfaces (WebSocket, REST) exposed to or reachable by autonomous browsing agents. Apply least-privilege network policies so agents cannot contact arbitrary localhost ports. If running AutoGen Studio from source, apply the official Microsoft-documented patches. PyPI installs of AutoGen Studio are not affected by this specific chain per Microsoft's disclosure.