AutoJack Exploit in Web-Enabled AI Agents: Bypassing Localhost Security

Key points

• Microsoft named the technique AutoJack: a malicious webpage, rendered by a local browsing agent, can reach a host machine's MCP service and execute arbitrary processes.
• Three chained flaws in AutoGen Studio's MCP WebSocket implementation make the attack possible.
• The vulnerable code existed only in development builds and never shipped via PyPI, so public-release users were not exposed.
• Fixes removed URL-based parameter injection, routed MCP paths through normal authentication, and tied server-side parameters to session identifiers.
• Microsoft says the underlying pattern extends beyond AutoGen to agentic frameworks broadly.

How does AutoJack actually work?

A browsing agent running locally inherits localhost identity. That single fact collapses the first line of defence. AutoGen Studio's MCP WebSocket implementation held an origin allowlist meant to accept connections only from localhost, but attacker-controlled JavaScript rendered by the agent satisfies that check automatically.

The second weakness: authentication logic excluded MCP WebSocket paths from normal checks, on the assumption those endpoints would enforce their own controls. They never did. Third, and worst, the MCP endpoint accepted a server_params value supplied through a URL, decoded it, and passed the result straight to the process-spawning mechanism. No allowlist restricted which executables could run. PowerShell, Bash, anything on the box.

Chain all three and a webpage triggers arbitrary process execution with no further user interaction beyond getting the agent to load the page. "When an agent on your core server or laptop can browse the open web and communicate with privileged local services, localhost stops being a trust boundary," Microsoft wrote in its blog post.

Should you worry if you installed via PyPI?

No. The vulnerable MCP-enabled code existed only in development builds. PyPI releases were never affected. For source installs, maintainers have since removed URL-based parameter injection, pushed MCP paths through standard authentication flows, and keyed server parameters to session identifiers rather than URL input.

What does this mean beyond AutoGen Studio?

Microsoft is explicit: AutoJack describes a pattern, not just a bug. "The general guidance still applies because the pattern, an agent on the box reaching localhost services, is broader than this one bug," it noted. The findings were reported to Microsoft's Security Response Center before any public release shipped the flawed code.

This lands in recognisable territory for anyone following multi-agent RCE. We first covered AutoGen Studio on 19 June 2026, and the LangGraph SQLi-to-RCE chain we reported on 12 June shows the same structural problem: trust boundaries that made sense for single-process software don't survive contact with agents that browse, spawn, and call local services freely.

The practical concern for teams running any agentic framework locally: audit what your agents can reach on localhost, don't assume an origin check holds when the agent itself is the origin, and treat the MCP layer with the same suspicion you'd give any unauthenticated network socket. Localhost has never been a perimeter, but AI agents make that painfully obvious.