Summary
- Microsoft identified an exploit chain in AutoGen Studio involving a local MCP WebSocket.
- The affected surface was addressed during development and was not included in the PyPI release.
- The research shows how AI agents can weaken localhost trust assumptions when browsing untrusted content.
Microsoft has disclosed AutoJack, an exploit chain showing how a malicious web page rendered by an AI browsing agent could reach a local Model Context Protocol WebSocket and spawn arbitrary processes on the host.
The research centres on AutoGen Studio, Microsoft Research’s open source prototyping interface for building multi-agent systems. Microsoft said the issue was reported to the Microsoft Security Response Center and addressed during development. The affected MCP WebSocket surface was not included in a Python Package Index release, so users who installed AutoGen Studio from PyPI were not exposed to this specific chain.
Microsoft’s AutoJack analysis describes three weaknesses that, when chained, created a remote code execution primitive. The MCP WebSocket accepted localhost origins, authentication middleware did not protect the MCP path, and a URL parameter could be decoded into command-line parameters that were executed.
In a conventional web security model, localhost protections can reduce exposure because a browser visiting an external site should not be able to reach a local service unless origin checks allow it. AI browsing agents complicate that model. When the agent renders untrusted web content on the same workstation as a local development tool, the attacker-controlled page may be operating through a process that appears local.
Microsoft’s research shows why localhost cannot be treated as a sufficient trust boundary when agents can browse the open web and communicate with privileged local services. Developers are connecting models to tools, repositories, APIs, command execution, local services, and MCP servers. Many of those environments are built for experimentation before they are hardened for enterprise use.
The risk is architectural. Agent systems can join previously separate zones: untrusted web content, local development tools, credentials, API keys, source code, and host-level execution. A design shortcut that appears reasonable in a local prototype can become severe once the agent has web access and tool authority.
Organisations testing agentic systems should treat development environments containing real credentials, internal code, cloud access, or customer data as sensitive environments. Experimental agents need isolation, authentication, authorisation, allowlisted tool execution, network controls, and monitoring. MCP servers and local control planes should be designed as exposed attack surfaces rather than convenience interfaces protected by loopback assumptions.
The specific AutoJack chain was fixed before reaching the stable PyPI release. The wider pattern remains relevant as agent frameworks move quickly and their security models mature. Enterprise adoption will require review of the plumbing that lets agents browse, call tools, execute code, and reach local services.
