AutoJack Exploit Enables RCE via AI Browsing Agents

Microsoft has identified a new exploit chain named AutoJack that allows attackers to achieve remote code execution (RCE) through web-enabled AI agents, specifically targeting AutoGen Studio. The exploit leverages three vulnerabilities in AutoGen's Model Context Protocol (MCP) WebSocket, including trust in localhost, missing authentication, and unsafe parameter handling. By chaining these weaknesses, a malicious webpage can execute arbitrary commands on the host machine without user interaction. The affected code was only present in development builds and never reached production, meaning users who installed AutoGen Studio from PyPI are not at risk. Microsoft has reported the vulnerabilities to its Security Response Center and has fixed the issues in the development version. This incident highlights the need for enhanced security measures for local interfaces exposed to AI agents.

Key Points: • AutoJack exploits AI browsing agents to achieve remote code execution on host machines. • The attack combines vulnerabilities in localhost trust, authentication, and parameter handling. • Affected code was fixed before reaching production, so users from PyPI are not at risk.