Microsoft Fixes AutoGen Studio Flaw That Could Enable Host Command Execution

Summary

Microsoft says the AutoJack vulnerability chain could let a malicious webpage trick an AutoGen Studio agent into running commands on its host. The flaw was fixed before PyPI release; developers who built from GitHub during a brief window were exposed.

Key points

Microsoft described AutoJack as a chain of three weaknesses in AutoGen Studio.
A malicious webpage visited by an agent could exploit trust in localhost WebSocket connections and missing authentication.
The MCP WebSocket accepted a base64-encoded server_params value that could be passed to process-launching code to run commands or executables.
Microsoft says the affected code was fixed before any PyPI release; developers building from the main GitHub branch during a limited window before commit b047730 were exposed.
Microsoft recommends isolated, low-privilege deployments and avoiding use with agents that browse untrusted content or execute arbitrary code.

Article Details

Vulnerability Types: Missing authentication on MCP WebSocket routes
Insufficient trust validation for localhost WebSocket connections
Arbitrary command execution through attacker-controlled process parameters
Affected Versions: AutoGen Studio built from the main GitHub branch between the MCP plugin landing and hardening commit b047730
Exploitation Status: unknown
Exploit Availability: unknown
Patch Status: available
Workarounds: Deploy AutoGen Studio as an isolated developer prototype that is not exposed to the internet.
Run it under a low-privilege account in a sandboxed user profile or container.
Do not run it with an agent capable of browsing or executing arbitrary code on a machine with untrusted content.

MITRE ATT&CK

T1059.001 · PowerShellThe vulnerable process-launching path could execute attacker-chosen PowerShell commands.T1059.004 · Unix ShellThe vulnerable process-launching path could execute attacker-chosen Bash commands.

Vendors

MicrosoftMicrosoft disclosed AutoJack, a chain of vulnerabilities in AutoGen Studio that could let a malicious webpage trick an AI agent into executing arbitrary commands on the host machine.

Products

AutoGenMicrosoft disclosed AutoJack, a chain of vulnerabilities in AutoGen Studio that could let a malicious webpage trick an AI agent into executing arbitrary commands on the host machine.AutoGen StudioMicrosoft disclosed AutoJack, a chain of vulnerabilities in AutoGen Studio that could let a malicious webpage trick an AI agent into executing arbitrary commands on the host machine.