AutoJack is a control-plane failure, not merely a case of an assistant giving a wrong answer. Microsoft describes hostile web content reaching a local MCP WebSocket and ultimately influencing a host process launch. The security consequence depended on a chain of capabilities: browser access to a local service, an authentication gap on the MCP path, and…
Inspect the ClaimsCase · DiggingBeagle record
AutoJack crossed from hostile web content into a local MCP control plane
Microsoft demonstrated a path from a hostile page opened by an agent to process execution through AutoGen Studio’s local MCP control plane. The affected development code was fixed before a PyPI release, according to Microsoft.
Localhost is not a trust boundary for agentsMCP control-plane exposureIndirect prompt injectionAgent authority
Scope
The affected AutoGen Studio development surface described by Microsoft. The vulnerable MCP WebSocket path was fixed in upstream main and, according to Microsoft, was never included in a PyPI release.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 3 of 4
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Primary vendor disclosure checked. Exposure excludes PyPI releases according to that disclosure; no independent runtime retest was performed in this enrichment.
Impact basis: Microsoft demonstrated transition into host process execution in the affected development surface. This does not imply deployment-wide compromise or production loss.
Assessed Oct 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CHAIN · CLM-THREE · CLM-NOT-PYPI · AutoJack: How a single page can RCE the host running your AI agent
At a glance
## Comparison The deprecated Python SDK WebSocket advisory concerns transport validation; AutoJack adds application authentication and process-parameter handling. The experimental-task advisory concerns ownership after admission. Together they support a three-part review: who can connect, which object a caller owns, and which action the object can…
Read the implicationsThe cited disclosure does not claim that the specific chain was exploited in real deployments. The affected development surface did not ship through PyPI according to Microsoft.
Limits and uncertaintyFull account
AutoJack is a control-plane failure, not merely a case of an assistant giving a wrong answer. Microsoft describes hostile web content reaching a local MCP WebSocket and ultimately influencing a host process launch. The security consequence depended on a chain of capabilities: browser access to a local service, an authentication gap on the MCP path, and server parameters that reached stdio execution.
The three boundaries
First, local reachability was treated as evidence of trust. Second, the MCP route did not enforce the expected application authentication. Third, parameters supplied through the exposed route determined executable configuration. Each boundary matters independently: rejecting an untrusted caller and refusing caller-selected executable definitions are different protections.
The report’s browsing-agent setup explains its demonstrated route. It should not be generalized into a claim that every headless browser receives a trusted localhost origin. Browser behavior, transport configuration and the specific application routes must be checked in a reproduction.
What was actually shipped
Microsoft states that the affected MCP WebSocket surface existed in upstream development but was never included in a PyPI release. This exclusion is central to the exposure assessment. A user of a packaged release and a developer running a checkout of the vulnerable code are not interchangeable affected populations. The disclosure does not provide a basis for counting all AutoGen users as victims.
Consequence and response
The demonstrated endpoint-to-stdio chain reached host process execution with the authority of the involved process. That is a substantial boundary even without evidence of production victims. The vendor describes an upstream change that moved executable parameters out of the exposed connection input and corrected authentication handling. This enrichment did not execute the exploit or independently retest the patched implementation.
A useful regression test
A defensive test should establish whether an unauthenticated or incorrectly scoped client can reach the control plane, whether the caller can supply executable definitions, and whether an authorized session can claim another session’s pending configuration. Test each decision independently. A single successful page rejection cannot establish that the downstream process-launch interface is safe when reached through another route.
Mechanism and trust boundary
- 01
Agent browses attacker-controlled page
A local browsing tool renders hostile web content on the developer workstation.
Boundary: open web / local agent
- 02
Page reaches localhost MCP WebSocket
In the reported browsing-agent setup, hostile content could reach the local service. Do not generalize this to all browser-origin behavior.
Boundary: web content / loopback control plane
- 03
MCP path bypasses application authentication
The WebSocket endpoint accepts the connection without its own authentication.
Boundary: application auth / MCP endpoint
- 04
Attacker-controlled server parameters become a command
AutoGen Studio passes decoded command and argument values to the stdio client.
Boundary: MCP request / host process
Timeline
- Mar 11, 2026mitigation
Upstream AutoGen commit hardens the MCP WebSocket surface
Microsoft cites upstream commit b047730 as the hardening change.
- Jun 18, 2026Event type unspecified
Microsoft publishes AutoJack research
The technical disclosure explains the three-part chain and mitigations.
Claims & evidence
CLM-CHAINMicrosoft reports that untrusted web content rendered by a browsing agent could reach AutoGen Studio's local MCP WebSocket and spawn arbitrary host processes.supported
Basis: reported finding
- supportsAutoJack: How a single page can RCE the host running your AI agentprimary disclosure
AutoJack chain at a glance
CLM-THREEThe chain combined a localhost origin assumption, an MCP authentication gap and attacker-controlled server parameters that were passed to stdio execution.supported
Basis: reported finding
- supportsAutoJack: How a single page can RCE the host running your AI agentprimary disclosure
Anatomy of the chain
CLM-NOT-PYPIMicrosoft states that the affected MCP WebSocket surface was fixed in upstream development and was never included in a PyPI release.supported
Basis: reported finding
Scope: Microsoft's disclosure about the specific AutoJack chain.
- supportsAutoJack: How a single page can RCE the host running your AI agentprimary disclosure
Fixes and hardening measures
Evidence visuals
diagram
AutoJack local control-plane chain
- Hostile web page
Attacker-controlled content
- Browsing agent
Renders page locally
- Local MCP WebSocket
Control plane lacks an independent trust decision
- Stdio server parameters
Command and arguments are attacker-influenced
- Host process
Process starts under developer account
- Hostile web page Browsing agent: rendered content
- Browsing agent Local MCP WebSocket: local-origin access
- Local MCP WebSocket Stdio server parameters: server params
- Stdio server parameters Host process: spawn
Implications
Comparison
The deprecated Python SDK WebSocket advisory concerns transport validation; AutoJack adds application authentication and process-parameter handling. The experimental-task advisory concerns ownership after admission. Together they support a three-part review: who can connect, which object a caller owns, and which action the object can authorize.
Conditional escalation
If a local control plane obtains wider filesystem, cloud or wallet authority, a similar caller-controlled execution path could have larger consequences. That is a conditional design analysis, not an assertion that the reported AutoJack test stole those assets. Least privilege limits consequences, while correct admission and server-owned execution configuration interrupt the path itself.
Controls and mitigations
- Authenticate every local control-plane endpoint, including WebSockets.
- Do not rely on localhost or Origin checks as the sole trust decision for agent-accessible services.
- Allowlist executable MCP server commands and arguments.
- Run browsing agents and developer control planes under separated identities and sandboxes.
- Place sensitive local services behind an authenticated reverse proxy or equivalent gate.
- DiggingBeagle review recommendation: keep executable configuration server-owned, bind pending configuration to the intended authenticated session, and reject cross-session claims.
- DiggingBeagle exposure check: distinguish development checkouts from released packages; do not mark every PyPI installation affected by a development-only path.
Unknowns and contradictions
- The cited disclosure does not claim that the specific chain was exploited in real deployments.
- The affected development surface did not ship through PyPI according to Microsoft.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 1
- Sep 25, 2026 · Published version · material revision · revision 37Public fields changed: assessment_profile
- Oct 1, 2026 · Published version · material revision · revision 65Public fields changed: assessment_profile, attack_path, claims, implications, links, mitigations, narrative, references, summary