AutoJack: How a single page can RCE the host running your AI agent

AutoJack is an exploit chain demonstrating that a single malicious webpage can cause remote code execution (RCE) on a host by manipulating an AI browsing agent. The attack abuses implicit trust in localhost, unauthenticated/unsafe handling of parameters, and AutoGen Studio’s MCP WebSocket to trigger arbitrary process execution on the host. The research highlights a systemic risk: when agents browse untrusted content and can access local services, traditional localhost boundaries and unauthenticated local endpoints become viable RCE vectors for attackers.