AutoJack Attack: One Malicious Web Page Can Hijack AI Agents for Remote Code Execution

Microsoft researchers have disclosed a novel exploit chain named AutoJack that allows a single malicious web page to hijack an AI browsing agent and achieve remote code execution on the host system. The attack requires no credentials, no sign-in, and no user interaction beyond the agent loading the attacker-controlled page.

The vulnerability resides in AutoGen Studio, the open-source prototyping interface for Microsoft Research’s AutoGen multi-agent framework. The flaw is present in pre-release versions 0.4.3.dev1 and 0.4.3.dev2 of the autogenstudio package on PyPI. These builds include a Model Context Protocol (MCP) WebSocket route that accepts commands directly from request parameters without authentication. The stable release 0.4.2.2 is not affected.

The AutoJack chain exploits three weaknesses in the MCP WebSocket: first, the socket trusts localhost connections, which a browsing agent on the same machine inherits; second, authentication middleware skips MCP paths; third, the endpoint runs any command from the request without an allowlist. An attacker only needs to get the agent to open a malicious page via a link, URL field, or prompt injection.

Microsoft has hardened the main branch in commit b047730 (PR #7362), but no patched PyPI release is available yet. Users who installed a pre-release should pull from GitHub main at or after that commit. Microsoft recommends not running AutoGen Studio on the same machine as a browsing agent that touches untrusted content, or isolating them in separate containers or VMs.

This attack pattern is expected to appear in other agent frameworks, as localhost checks are insufficient when agents can browse the open web and reach privileged local services.