AutoJack: How a single page can RCE the host running your AI agent

AutoJack is an exploit chain that demonstrates a single malicious webpage can escalate an AI browsing agent into a host remote-code-execution vector. The attack abuses trust in localhost, missing authentication and unsafe parameter handling in AutoGen Studio’s MCP WebSocket to trigger arbitrary process execution on the host. The report highlights a systemic risk: agentic browsing + access to local services removes traditional localhost boundaries and can expose hosts to RCE from untrusted pages. Recommended mitigations include blocking or strictly mediating agent access to localhost/local APIs