Case · DiggingBeagle record
Microsoft demonstrated a chain in an AutoGen Studio development surface where a browsing agent could render hostile web content that reached an unauthenticated local MCP WebSocket and spawned host processes.
The affected AutoGen Studio development surface described by Microsoft. The vulnerable MCP WebSocket path was fixed in upstream main and, according to Microsoft, was never included in a PyPI release.
AutoJack combined three individually familiar weaknesses. The MCP WebSocket accepted localhost origins, the main authentication middleware skipped MCP paths, and a server-parameter field could become a command line for an MCP stdio server.
A normal remote browser would fail the localhost-origin check. A browsing agent running on the developer machine changed that assumption because hostile content could be rendered by a local process. The web page could then open the MCP WebSocket, pass attacker-controlled server parameters and cause AutoGen Studio to spawn a process under the developer account.
Microsoft says the issue was found and fixed during development before the affected surface reached a PyPI release. The value of the case is therefore structural: it shows how an agent can become a confused deputy across a boundary that was considered local.
A local browsing tool renders hostile web content on the developer workstation.
Boundary: open web / local agent
The local agent defeats the assumption that a localhost origin implies a trusted human browser.
Boundary: web content / loopback control plane
The WebSocket endpoint accepts the connection without its own authentication.
Boundary: application auth / MCP endpoint
AutoGen Studio passes decoded command and argument values to the stdio client.
Boundary: MCP request / host process
Microsoft cites upstream commit b047730 as the hardening change.
The technical disclosure explains the three-part chain and mitigations.
Locator: AutoJack chain at a glance
Microsoft describes hostile web content crossing the local MCP boundary and reaching process execution.
Locator: Anatomy of the chain
Microsoft documents the three weaknesses as the conditions that compose the exploit.
Scope: Microsoft's disclosure about the specific AutoJack chain.
Locator: Fixes and hardening measures
The disclosure says the affected surface did not ship in the PyPI release line.
diagram
Attacker-controlled content
Renders page locally
Control plane lacks an independent trust decision
Command and arguments are attacker-influenced
Process starts under developer account
Localhost should not be treated as authenticated simply because a service is not internet-facing. Privileged control planes need explicit authentication and authorization, dangerous executable parameters need allowlists, and browsing agents should run under identities that do not inherit the developer's local authority.
DiggingBeagle. “AutoJack crossed from hostile web content into a local MCP control plane.” First seen Jun 18, 2026. https://diggingbeagle.com/cases/autojack-crossed-from-hostile-web-content-into-a-local-mcp-control-plane/
Citation guidanceWhy this archive exists
DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.
We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.