Evidence · DiggingBeagle record
AutoJack: How a single page can RCE the host running your AI agent
Vendor technical reconstruction of AutoJack’s local MCP control-plane chain. The disclosure states that the affected development surface never shipped in a PyPI release. Its reported patch is not an independent DiggingBeagle runtime retest.
- Published
- Jun 18, 2026
- Accessed
- Oct 1, 2026
- Publisher
- Microsoft Security
- Source role
- primary disclosure
- Version
- 2026-06-18
- Rights
- Public web source; citation and short excerpt only.
Evidence record
Vendor technical reconstruction of AutoJack’s local MCP control-plane chain. The disclosure states that the affected development surface never shipped in a PyPI release. Its reported patch is not an independent DiggingBeagle runtime retest.
Claim-level citations (3)
- supportsAutoJack crossed from hostile web content into a local MCP control plane: Microsoft reports that untrusted web content rendered by a browsing agent could reach AutoGen Studio's local MCP WebSocket and spawn arbitrary host processes.
AutoJack chain at a glance
- supportsAutoJack crossed from hostile web content into a local MCP control plane: The chain combined a localhost origin assumption, an MCP authentication gap and attacker-controlled server parameters that were passed to stdio execution.
Anatomy of the chain
- supportsAutoJack crossed from hostile web content into a local MCP control plane: Microsoft states that the affected MCP WebSocket surface was fixed in upstream development and was never included in a PyPI release.
Fixes and hardening measures