AutoJack: How a single page can RCE the host running your AI agent

Microsoft Security Blog disclosed “AutoJack,” an exploit chain where a single malicious webpage can escalate an AI browsing agent’s access into remote code execution on the host. The attack abuses implicit trust in localhost, missing authentication and unsafe parameter handling in AutoGen Studio’s MCP WebSocket to trigger arbitrary process execution. Microsoft frames AutoJack as a broader class of risk: when agents browse untrusted content and can reach local services, traditional localhost protections and assumptions break down. The feed also includes related Microsoft coverage on supply‑side