DIGGINGBEAGLE
Home/concepts

Topic · DiggingBeagle record

Localhost is not a trust boundary for agents

A local agent can make attacker-controlled content effectively local to privileged developer services.

Topic kind
pattern

Definition & limits

Origin and loopback assumptions that work for a human browser may fail when an agent itself browses hostile content on the same machine as a control plane.

Examples

  • AutoJack's browsing-agent path into AutoGen Studio.
  • Browser-reachable local MCP services with wildcard CORS.

Research using this topic (6)

AnalysisWhat the 2026 agent incidents changed about evaluation securityAnalysisThe sandbox was isolated. The shared service was not.CaseAutoJack crossed from hostile web content into a local MCP control planeCaseA deprecated MCP WebSocket transport trusted the browser originCaseWindows-MCP HTTP modes exposed PowerShell behind a weak control planeNewsMCP Python SDK advisories expose task ownership and browser-origin gaps

Cite this record

DiggingBeagle. “Localhost is not a trust boundary for agents.” https://diggingbeagle.com/concepts/localhost-is-not-a-trust-boundary-for-agents/

Citation guidance

Why this archive exists

The source matters after the headline fades.

DiggingBeagle is a non profit research project documenting AI security incidents, agent failures, vulnerabilities and AI-assisted operations. A case keeps its claims beside the sources that support, contest or limit them. Later updates stay visible, so a reader can see when the account changed.

We publish case reconstructions, dated reporting and analysis across records. Each has a different evidentiary role. About the project and our methodology explain how the work is reviewed.