AutoJack Uses AI Browsing Agent to Trigger Host RCE in AutoGen Studio Pre-Releases

Summary

AutoJack chains localhost trust, skipped authentication, and unauthenticated command execution in AutoGen Studio prereleases to let a page loaded by an AI browsing agent trigger host code execution. Stable 0.4.2.2 is unaffected; a fix is in the main branch.

Key points

A page loaded by a local AI browsing agent can reach AutoGen Studio’s MCP WebSocket service and run an attacker-chosen command under the Studio process account.
The chain relies on a localhost trust check, MCP routes skipped by authentication middleware, and an endpoint that executes a command supplied in a request parameter.
The vulnerable route was present in prereleases 0.4.3.dev1 and 0.4.3.dev2. Stable release 0.4.2.2 has no MCP route and is unaffected.
Microsoft described AutoJack as research and reported no exploitation in the wild; its proof of concept launched calc.exe through a Web Content Summarizer agent.
The maintainers hardened the main branch at commit b047730: commands are no longer read from the URL, session IDs are checked, and MCP routes use normal authentication. No fixed PyPI release was available in the article.
For affected prerelease users, the article recommends using the fixed main-branch code. It also advises separating AutoGen Studio from agents handling untrusted content, or isolating them in containers or VMs.

Article Details

Attack Vectors: An attacker-controlled web page loaded by a local AI browsing agent uses JavaScript to reach AutoGen Studio's localhost MCP WebSocket route.
In vulnerable pre-release builds 0.4.3.dev1 and 0.4.3.dev2, the MCP route accepted unauthenticated connections and executed a command supplied in a request parameter without an executable allowlist.
The proof of concept used a Web Content Summarizer agent to trigger calc.exe on the developer's desktop. Microsoft reported no exploitation in the wild.
Defensive Notes: Avoid installing the vulnerable pre-release builds. The article says stable PyPI release 0.4.2.2 was not exposed, while the fix is in GitHub main at commit b047730 and had not yet landed in a PyPI release.
For affected pre-release installations, use GitHub main at or after commit b047730.
Do not run AutoGen Studio on the same machine as an agent that browses or executes code from untrusted content; if separation is not possible, isolate them in separate containers or VMs.
Run AutoGen Studio with a low-privilege account, authenticate MCP routes, and restrict process execution with an allowlist.