Back Feeds.4Sysops

AutoJack exploit chain allows web-enabled AI agents to trigger host

Feeds.4Sysops •IT News • June 19, 2026

Microsoft researchers have identified a critical exploit chain named AutoJack that allows malicious web content to compromise the host machine running an AI agent. The vulnerability specifically targeted AutoGen Studio, a prototyping interface for multi-agent systems, by abusing its trusted local access. By chaining three separate weaknesses, an attacker can bypass localhost security boundaries to execute arbitrary commands under the developer's account. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AutoJack Exploit Enables RCE via AI Browsing Agents Microsoft has identified a new exploit chain named AutoJack that allows attackers to achieve remote code execution (RCE) through web-enabled AI agents, specifically targeting AutoGen Studio. The exploit leverages three vulnerabilities in AutoGen's Model Context Protocol (MCP) WebSocket, including trust in localhost, missing authentication, and unsafe parameter handling. By chaining these weaknesses, a malicious webpage can execute arbitrary commands on the host machine without user interaction. The affected code was only present in development builds and never reached production, meaning users who installed AutoGen Studio from PyPI are not at risk. Microsoft has reported the vulnerabilities to its Security Response Center and has fixed the issues in the development version. This incident highlights the need for enhanced security measures for local interfaces exposed to AI agents. 11 sources 61

AutoJack exploit chain allows web-enabled AI agents to trigger host

The full story

Extracted Entities

MITRE ATT&CK (1)

Tools (1)