AutoJack: How a single page can RCE the host running your AI agent | Microsoft Security Blog

What it is

AutoJack is a demonstrative exploit chain in AutoGen Studio's MCP WebSocket surface (Microsoft's AutoGen prototyping UI), from Microsoft's ongoing agent-framework security series (an earlier post covered RCE primitives in Semantic Kernel). It turns a browsing agent into a "confused deputy" that crosses the localhost trust boundary and spawns arbitrary processes on the host. The page states the chain does not work on current builds and was fixed in upstream commit b047730 before any PyPI release included the surface.

How it works

The mechanism the summary flags but doesn't spell out is why the origin allowlist fails: the WebSocket accepts Origin: http://127.0.0.1 / http://localhost. That correctly blocks a human browser pointed at evil.com. But an AutoGen agent's built-in web tooling — MultimodalWebSurfer, fetch_webpage_tool, any Playwright-backed surfer, or a code-execution tool running requests/websockets — is itself a localhost process. JavaScript it renders inherits the localhost identity, so the WebSocket call it makes satisfies the allowlist. The endpoint then takes a server_params query parameter, base64-decodes a JSON blob into StdioServerParams, and hands command + args to stdio_client(...) with no allowlist — calc.exe, powershell.exe -enc …, bash -c '…' all run as "MCP servers." No user interaction beyond getting the agent to render the attacker's page.

flowchart LR
  A[Attacker page on open web] --> B{Origin check<br/>localhost only}
  B -->|human browser at evil.com| X[Blocked]
  B -->|JS run by agent's<br/>headless browser| C[Passes: agent is localhost]
  C --> D{Auth middleware}
  D -->|/api/mcp/* opt-out| E[No auth check]
  E --> F[server_params -> stdio_client<br/>arbitrary command]

Preconditions / Affected

Matters only if an agent that can browse untrusted pages also runs on the same host as a privileged local service reachable over loopback. AutoGen Studio installed from PyPI is not exposed to this specific chain. The value here is pattern recognition for other agent frameworks with the same shape.

What to do

The page gives a defensive principle, not commands: when an agent on your server or laptop can browse the open web and talk to privileged local services, treat localhost as an attack surface, not a trust boundary. Control planes must be authenticated, authorized, and isolated. Note the two design traps to audit for elsewhere: origin allowlists that assume localhost = trusted, and auth middleware that opt-outs paths (/api/mcp/*, /api/ws/*) on the assumption the handler does its own check — when it doesn't.

Caveats

This is retrospective and demonstrative: the chain is fixed, doesn't work on current builds, and never shipped in a PyPI release. There is no CVE, patch command, or detection rule to apply — the takeaway is the reusable pattern, not a live fix.