LIVE FEED
HIGH Legacy Infrastructure Becomes Primary Attack Path into Enterprise AI Agents // HIGH Role Confusion Attack Lets Injected Text Override LLM Safety Controls // FIRST LOOK First Look: OpenAI Launches 'Patch the Planet' Open-Source Vulnerability Remediation … // HIGH AutoJack Vulnerability Chain Enabled Remote Code Execution via AI Agent WebSocket // FIRST LOOK First Look: AWS Launches Amazon Bedrock AgentCore Payments Enabling Autonomous Agent … // FIRST LOOK First Look: OpenAI ChatGPT Image Generator Bypasses Content Filters via Viral Prompt // FIRST LOOK First Look: Bayer and Thoughtworks Ship PRINCE Agentic RAG Platform for Pharmaceutical … // FIRST LOOK First Look: Anthropic Claude Code Gains Fully-Local Persistent Session Memory via Recall // FIRST LOOK First Look: OpenAI Ships GPT-5.5 Instant with Enhanced Health Intelligence in ChatGPT // HIGH Malware Embeds Policy-Triggering Text to Evade LLM-Based Security Analysis //
ATLAS OWASP HIGH Significant risk · Prioritise patching Agentic AI LLM Security Supply Chain RELEVANCE ▲ 8.5

AutoJack Vulnerability Chain Enabled Remote Code Execution via AI Agent WebSocket

SOURCE BleepingComputer ↗
TL;DR HIGH
  • What happened: Three chained flaws in AutoGen Studio's MCP WebSocket allowed arbitrary command execution on developer machines.
  • Who's at risk: Developers building AutoGen Studio from the main GitHub branch during the vulnerable window, as the flaw never shipped in a published PyPI package.
  • Act now: Verify you are running a patched build of AutoGen Studio and not a pre-hardening commit from the main branch · Enforce authentication on all local API and WebSocket endpoints, including MCP routes, in any custom AutoGen deployments · Audit AI agent browsing permissions and restrict the execution of externally influenced code or commands
AutoJack Vulnerability Chain Enabled Remote Code Execution via AI Agent WebSocket

Overview

Microsoft has disclosed and patched a vulnerability chain called AutoJack affecting AutoGen Studio, the graphical interface for its open-source multi-agent AI framework. The flaw allowed an attacker to trigger arbitrary command execution on a developer’s machine simply by having an AI browsing agent visit a malicious webpage — a scenario with serious implications for the growing ecosystem of agentic AI developer tooling.

AutoGen Studio is widely used, with the underlying project accumulating over 59,000 GitHub stars. The severity here lies not just in the technical flaws, but in what they reveal about the security posture of AI agent infrastructure: local services trusted implicitly, authentication gaps in AI-native APIs, and agent autonomy weaponised against the host system.

Technical Analysis

AutoJack chains three distinct weaknesses:

  1. Origin trust misconfiguration: The MCP WebSocket endpoint implicitly trusts connections from localhost. A browsing agent running on the same machine can be manipulated into loading attacker-controlled JavaScript that appears to originate from a trusted local source, bypassing origin checks.

  2. Authentication bypass on MCP routes: AutoGen Studio’s authentication middleware explicitly excludes /api/mcp/* routes from credential checks, and the MCP WebSocket itself implements no independent authentication — leaving it fully open to unauthenticated connections.

  3. Unsanitised base64 parameter execution: The MCP WebSocket accepts a server_params value supplied as a base64-encoded string in the URL. This value is passed directly to process-launching code, enabling an attacker to specify and execute arbitrary PowerShell commands, Bash scripts, or executables with the privileges of the developer’s account.

In a demonstrated attack scenario, malicious JavaScript on a visited page opens a WebSocket connection to AutoGen Studio’s local MCP endpoint. The payload instructs the process launcher to execute an attacker-chosen binary — Microsoft demonstrated this by launching calc.exe, a classic proof-of-concept for arbitrary execution.

Framework Mapping

  • AML.T0051 (LLM Prompt Injection): The attack vector flows through the agent’s web browsing capability, using attacker-controlled page content to redirect agent behaviour toward malicious WebSocket interactions.
  • AML.T0047 (ML-Enabled Product or Service): AutoGen Studio as an AI product surface introduced the vulnerable integration point.
  • LLM07 (Insecure Plugin Design): The MCP plugin integration lacked authentication and failed to validate externally supplied execution parameters.
  • LLM08 (Excessive Agency): The AI agent’s ability to initiate local process execution without human-in-the-loop controls amplified the impact of the initial compromise.

Impact Assessment

Microsoft confirmed the vulnerable code never shipped in a published PyPI package. Exposure was limited to developers who cloned and built AutoGen Studio from the main GitHub branch during the window between the MCP plugin merge and the hardening commit. Despite this limited blast radius, the attack class is significant: it demonstrates that agentic AI tooling can transform a routine browsing task into a full host compromise, and that developer machines — typically highly privileged environments — are valid and valuable targets.

Mitigation & Recommendations

  • Verify build integrity: Confirm any AutoGen Studio build is sourced from a post-hardening commit or an official PyPI release.
  • Enforce endpoint authentication: All local WebSocket and API endpoints, including those under MCP routes, should require authentication even within loopback contexts.
  • Sanitise execution parameters: Never pass externally supplied or agent-processed values directly to process-launching functions without strict allowlisting.
  • Restrict agent execution scope: Apply least-privilege principles to AI agent capabilities; browsing agents should not have access to local process execution APIs.
  • Treat localhost as untrusted: Origin-based trust for local services is insufficient when AI agents can be influenced by external web content.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.