AutoJack: When the AI Browser Becomes the Initial Access Broker

Key points

• Microsoft researchers have named and detailed an exploit chain called AutoJack that lets a single web page trigger host-level code execution through an AI browsing agent.
• The attack reaches a privileged local service via the agent's own browser context, requiring no credentials, no consent dialog, and no further user action.
• The vulnerability is a local privilege boundary failure, not a prompt-injection or model-layer problem.
• No CVE has been assigned yet; the research describes a class of issue across agentic browser architectures, not one specific product.
• Anyone running an AI browser agent with a local control plane should treat that service as a network-exposed attack surface.

An AI agent that browses the web on your behalf is, functionally, a confused deputy with a keyboard.

Microsoft researchers have published details of an exploit chain they call AutoJack. The premise is uncomfortably simple: steer an AI browsing agent to an attacker-controlled page, and that page's JavaScript reaches a privileged local service running on the same machine and spawns a process on the host.

No credentials required. No second click.

The chain hinges on a trust assumption baked into a lot of agentic browser tooling: that traffic originating from a loopback interface is implicitly authorized. When the AI agent loads the malicious page in its own browser context, the page's script is routed through enough to call into the local helper service the agent uses to control the host. That service was designed to let the agent launch tools or interact with the filesystem. It will do the same for whatever script reaches it first.

The attacker never needs to compromise the agent's model or jailbreak its system prompt. The page is the payload, full stop.

That distinction matters because most public discussion of agent security has fixated on prompt-injection defenses and guardrail tuning. AutoJack sidesteps the model layer entirely. It's a classic local privilege boundary failure dressed in AI clothing. We covered the first confirmed instance of this class of issue on 19 June in AutoJack Exploit in Web-Enabled AI Agents: Bypassing Localhost Security, which reported Microsoft's discovery of a remote code execution vulnerability in AutoGen Studio through local agent misuse. This new research generalizes that finding across agentic browser architectures broadly.

No CVE has appeared in public databases at time of writing. Microsoft disclosed this as a class of issue rather than a single shipped product bug. Expect follow-on CVEs against specific vendors as the disclosure timeline plays out.

There is no breach-notification dimension yet: no exposed records, no regulator filing, no named victim. The exposure is prospective, which is exactly why it deserves attention now rather than after an incident.

Should you worry?

If you run an AI agent that drives a browser on your workstation, yes. The local helper service those agents rely on is the real attack surface, not the model.

Audit which ports it binds and whether it authenticates callers beyond an origin check. Restrict the agent to an allowlist of trusted domains where feasible. Run it in a separate user account or container so a successful host-spawn doesn't immediately reach your real files. Watch endpoint telemetry for child processes parented to the agent binary that you didn't ask for.

What to watch next: whether any browser-agent vendors ship authenticated local APIs before the first CVE drops, or whether, as with so many "implementation detail" services before them, the patch comes after the proof of concept.