AutoJack: How a single page can RCE the host running your AI agent

AutoJack is an exploit chain where a single malicious webpage can cause remote code execution on the host running an AI browsing agent. The attack abuses trust in localhost, missing or weak authentication, and unsafe parameter handling to reach and command local services—specifically leveraging AutoGen Studio’s MCP WebSocket—to trigger arbitrary process execution. It highlights a systemic risk: agents that browse untrusted content and have access to local services remove traditional localhost boundaries and can expose hosts to RCE.