Microsoft researchers disclosed an exploit chain named 'AutoJack' found in the open-source prototyping UI AutoGen Studio. This vulnerability allows a single untrusted web page browsed by an agent to reach a local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes on the host.
Microsoft Defender Security Research Team discovered a critical exploit chain in AutoGen Studio, an open-source prototyping UI. Named 'AutoJack,' this vulnerability allows a single untrusted web page browsed by an agent to reach a local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes (RCE) on the host.
AutoGen Studio is the prototyping user interface for the AutoGen multi-agent system framework. The exploit chain arises when an agent's untrusted web content rendering is combined with communication to a local privileged service (MCP server). The security team reported the issue to MSRC, and the maintainers have since patched the main branch. The specific vulnerability is not present in the current PyPI release.
This finding underscores a vital lesson for AI agent security design. If an agent can browse untrusted web content and communicate with local privileged services, localhost ceases to be a trust boundary. Authentication, authorization, and isolation for control planes are essential even in prototyping environments, and these considerations must be part of an agent framework's design from the outset.