Auto Jack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Summary: Microsoft researchers detailed an exploit chain called AutoJack that turns an AI browsing agent into a remote code execution vehicle: a page the agent loads can use JavaScript to reach a privileged local service and spawn a process on the host, with no credentials or further user interaction. The flaw sits in AutoGen Studio's MCP WebSocket handler, which shipped to PyPI only in pre-release builds 0.4.3.dev1 and 0.4.3.dev2 (neither yanked), while the stable 0.4.2.2 has no MCP route; the fix is in GitHub main at commit b047730 and has not landed in a PyPI release.
Why it matters: The chain works because a browsing agent on the same machine is localhost, so a check meant to block malicious websites passes anything the agent loads - and anyone who installed those two pre-releases has the vulnerable handler with no patched PyPI build to move to.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026