AutoJack: How a single page can RCE the host running your AI agent

AutoJack is a chained exploit that shows a single malicious webpage can achieve remote code execution on the host running an AI browsing agent. The attack abuses the agent’s ability to load untrusted pages and access localhost services, leveraging missing authentication and unsafe parameter handling in AutoGen Studio’s MCP WebSocket to trigger arbitrary process execution on the host. The report highlights a class of risks when agents browse untrusted content and can reach local service endpoints (localhost), effectively turning agent browsing into a host RCE vector.