AutoJack: How a single page can RCE the host running your AI agent

This collection highlights several high-impact security issues and research advances. The headline is “AutoJack,” a novel exploit chain where a single malicious webpage can turn an AI browsing agent into an RCE vector on the host by abusing localhost trust, missing authentication, and unsafe parameter handling in AutoGen Studio’s MCP WebSocket (arbitrary process execution on the host). Other notable items: a Mastra npm supply‑chain compromise that delivered a postinstall payload and infected 140+ projects; a crypto clipper campaign that steals clipboard data, replaces wallets, uses Tor for C2,