Microsoft warns about AutoJack: a web page can turn an AI agent into a remote code execution path

Microsoft published new security research highlighting an emerging risk in the current wave of AI agents: when an agent can browse web pages and also communicate with privileged local services, the traditional security assumption around “localhost” may no longer be enough.

Microsoft Defender Security Research called the technique AutoJack. In the demonstration, a malicious web page rendered by a browsing agent could reach a local Model Context Protocol, or MCP, service and spawn arbitrary processes on the host machine. The proof of concept targeted AutoGen Studio, the open source interface for building and testing multi-agent applications on top of AutoGen.

What Microsoft found

According to Microsoft, AutoJack chained three weaknesses in AutoGen Studio’s MCP WebSocket implementation. The first involved an origin allowlist designed to accept connections from localhost. Under normal conditions, that would block an external malicious page. But if the local agent itself is the one visiting or rendering the page, attacker-controlled code can abuse the agent’s local identity.

The second weakness was in the authentication logic: MCP WebSocket routes were excluded from some normal authentication checks under the assumption that those endpoints would implement their own controls. The third issue was the most critical: the endpoint accepted parameters from the URL and could pass them into the mechanism used to launch MCP servers, without a strict allowlist of permitted executables. Chained together, those conditions could allow a malicious page to trigger processes such as PowerShell, Bash, or other binaries, depending on the platform.

Not a public PyPI flaw, but a warning for the agent ecosystem

Microsoft emphasized that the affected code existed in development builds with MCP support and was not included in a published PyPI release. In other words, users who installed AutoGen Studio from PyPI were not exposed to this specific chain. The company reported the issue to the Microsoft Security Response Center, and maintainers hardened the main branch by removing URL-based parameter injection, routing MCP paths through normal authentication flows, and handling parameters server-side through session identifiers.

Even so, the significance of AutoJack extends beyond AutoGen Studio. Microsoft frames the case as a design warning for the broader agent ecosystem: modern agents do not merely generate text; they read files, browse sites, call APIs, execute tools, and connect to local services. That usefulness also creates a new attack surface.

Why it matters

The finding arrives as companies and developers connect agents to browsers, code interpreters, terminals, internal APIs, and MCP servers. In that context, a web page is no longer just passive content for an agent to read. If the agent has broad permissions, that page can become an entry point into more sensitive tools.

The practical lesson is clear: agent systems need isolation, strong authentication, per-tool authorization, command allowlists, separation between browsing and execution, and monitoring of local processes. For enterprise projects, AutoJack is less about one isolated bug and more about how the threat model changes when AI moves from chatbot to software operator.

CSO Online, which reported on the case, summarized the risk directly: a malicious page rendered by a web-enabled AI agent can reach local MCP services and execute processes on the host. Microsoft presents AutoJack as preventive research, but the message for security teams is immediate: if an agent can touch both the browser and the local machine, “localhost” is not a security boundary by itself.