AutoJack: How a single page can RCE the host running your AI agent

Microsoft disclosed “AutoJack,” an exploit chain where a single malicious webpage can cause an AI browsing agent to execute arbitrary commands on its host. The chain abuses trust in localhost, missing authentication, and unsafe parameter handling in AutoGen Studio’s MCP WebSocket to achieve remote code execution on the host. Microsoft highlights this as a broader class of risk when agents can browse untrusted content and reach local services, and recommends hardening local services, enforcing authentication, and restricting agent network access.