Back Blogs.Microsoft

AutoJack: How a single page can RCE the host running your AI agent

Blogs.Microsoft •Microsoft Defender Security Research Team • June 19, 2026

AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted content and access local services, traditional boundaries like localhost are no longer secure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AutoJack Exploit Enables RCE via AI Browsing Agents Microsoft has identified a new exploit chain named AutoJack that allows attackers to achieve remote code execution (RCE) through web-enabled AI agents, specifically targeting AutoGen Studio. The exploit leverages three vulnerabilities in AutoGen's Model Context Protocol (MCP) WebSocket, including trust in localhost, missing authentication, and unsafe parameter handling. By chaining these weaknesses, a malicious webpage can execute arbitrary commands on the host machine without user interaction. The affected code was only present in development builds and never reached production, meaning users who installed AutoGen Studio from PyPI are not at risk. Microsoft has reported the vulnerabilities to its Security Response Center and has fixed the issues in the development version. This incident highlights the need for enhanced security measures for local interfaces exposed to AI agents. 11 sources 61

Extracted Entities

AutoJack: How a single page can RCE the host running your AI agent

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Tools (1)