LIVE FEED
CRITICAL Claude AI Used by Yemen Cell to Develop Guided Missiles // HIGH BragJack Hijacks AI Browser Agents via Malicious Extensions // FIRST LOOK AWS Adds Defense-in-Depth Authorization for MCP Tools on Amazon Q // FIRST LOOK Anthropic CEO Calls for AI Control Over Capability Race // HIGH Claude Used to Breach OpenAI Employee Account via Forum Flaw // FIRST LOOK Anthropic Embeds Accenture as Its First Third-Party AI Safety Evaluator // CRITICAL AI Hallucination in Military Intel Nearly Triggers US Strike // FIRST LOOK arXiv Paper Formalises Linguistic Illegibility in LLM Security // HIGH Gemini AI Agent Breaches Three Companies via Password Guessing // HIGH Google Gemini Breaches Real Systems in AI Security Test Mishap //
AUTOJACK

Autojack

2 reports
All LLM Security Agentic AI Industry News Research Supply Chain First Look: Security Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report AI Governance AI Security AI Security Tools Identity & Access Management Monthly Review Security Operations
AutoJack: Microsoft AutoGen Studio RCE via MCP WebSocket

AutoJack: Microsoft AutoGen Studio RCE via MCP WebSocket

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 8.5 BleepingComputer

A three-flaw vulnerability chain dubbed AutoJack in Microsoft's AutoGen Studio allowed attackers to execute arbitrary commands on a developer's host system by manipulating a browsing AI agent into connecting to a malicious webpage. The attack exploited missing authentication on MCP WebSocket routes combined with unsanitised base64-encoded parameters to launch arbitrary processes. Microsoft confirmed the flaw was patched before any PyPI release, limiting exposure to developers building directly from the main GitHub branch.

AutoGen Studio RCE: AutoJack Exploit Chain Targets Developers

AutoGen Studio RCE: AutoJack Exploit Chain Targets Developers

ATLAS OWASP HIGH Significant risk · Prioritise patching ▲ 9.1 The Hacker News

Microsoft researchers disclosed AutoJack, an exploit chain targeting AutoGen Studio's MCP WebSocket endpoint that allows a single malicious web page to execute arbitrary commands on a developer's host machine via an AI browsing agent. The attack chains three distinct weaknesses — localhost trust bypass, missing authentication on MCP paths, and unsanitised command execution — requiring no credentials or user interaction beyond the agent loading the attacker's URL. While the vulnerable handler was not included in stable PyPI releases, it shipped in two pre-release builds that remain unyanked, leaving anyone who installed those versions exposed.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.