Microsoft is warning about a new remote code execution (RCE) route possible through web-based AI agents, demonstrating the technique against AutoGen Studio, its open-source interface for building and testing multi-agent applications. The demonstration showed that a malicious web page rendered by an AutoGen-enabled browser agent could reach a local Model Context Protocol (MCP) and execute arbitrary processes on the hosting machine.
See also: Microsoft: Clipper malware campaign targets Windows
Microsoft researchers have dubbed the technique “AutoJack” because it essentially takes over an AI agent that has internet access and abuses trusted local access to bypass localhost security boundaries. The attack combines three separate vulnerabilities in AutoGen Studio’s MCP WebSocket implementation, though Microsoft said the issue extends beyond AutoGen and could affect a broader class of agent frameworks.
“When an agent on your main server or laptop can browse the open internet and communicate with privileged local services, localhost ceases to be a trust boundary,” the blog post states. The findings were reported internally to the Microsoft Security Response Center (MSRC), and the affected AutoGen Studio code was reportedly patched before it reached a public PyPI release.
The AutoJack attack combined three separate vulnerabilities in AutoGen Studio’s MCP WebSocket implementation. The first involved an origin whitelist designed to only accept connections from localhost. Under normal circumstances, this protection would block a browser visiting a malicious external website. However, Microsoft discovered that a browser agent running locally inherits the identity of localhost, allowing attacker-controlled JavaScript rendered by the agent to satisfy the origin check.
The second issue arose from the authentication logic. The AutoGen Studio authentication process excluded MCP WebSocket routes from the normal authentication checks, assuming that these endpoints would implement their own checks. According to Microsoft, the MCP route never enforced these additional checks, leaving the interface accessible without authentication regardless of the configured authentication mode.
See also: DragonForce exploits Microsoft Teams broadcasts
The third was the most dangerous of the issues. The MCP endpoint accepted a “server_params” value provided via URL, decoded it, and passed the resulting command and arguments directly to the process launcher used for MCP servers. Because no whitelist restricted which executables could be launched, attackers could specify arbitrary commands such as PowerShell, Bash, or other binaries.
Microsoft said that the chain of these vulnerabilities allowed a website to cause arbitrary process execution on the machine hosting AutoGen Studio without any additional user interaction beyond causing the agent to render the page. Microsoft said that the vulnerable code was only present in development builds that included MCP support and was never released through the current PyPI release.
This means that users who installed AutoGen Studio via PyPI were never exposed to AutoJack. For those who install AutoGen Studio from source, the maintainers subsequently removed parameter injection via URL, made MCP paths available through normal authentication flows, and implemented server-side parameter handling with session authentication keys.
Beyond the specific bugs, Microsoft says AutoJack illustrates a pattern in agent frameworks. “The general guidance still applies because the pattern (an agent in a box reaching localhost services) is broader than this one bug,” it says. AutoJack was the result of Microsoft’s active research into how traditional software risks change when AI models are connected to tools, browsers, code interpreters, and local services.
See also: Microsoft confirms RoguePlanet Defender zero-day – Preparing patch
The findings come as Microsoft strengthens AI agent initiatives across its product portfolio, expanding its investments in agent governance, restrictive security, and autonomous security systems.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
