AutoJack RCE in AutoGen Studio: Security Lessons

Introduction

Microsoft has published new research on AutoJack, an exploit chain affecting AutoGen Studio’s development code path. The issue matters because it shows how AI agents that browse untrusted websites and interact with local tools can turn localhost into an attack surface, creating a path to remote code execution (RCE).

While Microsoft notes that this specific MCP WebSocket surface was never included in a PyPI release, the broader security lesson applies to many emerging agent platforms.

What’s new

Microsoft Defender Security Research described a three-part exploit chain in AutoGen Studio:

• Origin allowlist weakness: The MCP WebSocket trusted localhost origins, but a local AI browsing agent effectively runs as localhost and can satisfy that check.
• Authentication gap: Middleware excluded /api/mcp/* and related WebSocket paths from normal authentication, assuming the endpoint would enforce its own checks.
• Command execution via URL parameters: A server_params query parameter could be base64-decoded into command-line arguments and passed directly to process execution without an allowlist.

Combined, these weaknesses allowed a malicious webpage rendered by a local agent to open a WebSocket to AutoGen Studio on localhost and spawn arbitrary processes under the user’s account.

Why this matters for IT and security teams

The biggest takeaway is that loopback is not a security boundary when AI agents can browse the web and communicate with local privileged services.

For security teams, this research reinforces several priorities:

• Treat AI agent frameworks as high-risk control planes during evaluation.
• Require authentication and authorization for local APIs and WebSockets.
• Isolate agent tooling from sensitive developer workstations and servers.
• Review any feature that allows agents to launch tools, shells, or external processes.

Even though this exact chain was not exposed through the published PyPI package, similar design patterns may exist in other agent frameworks and internal prototypes.

Fixes and mitigation guidance

According to Microsoft, the maintainers hardened the upstream main branch after disclosure. Organizations experimenting with agent frameworks should also take these steps:

• Update to the latest hardened build of AutoGen Studio and related components.
• Avoid exposing local MCP or control-plane services to untrusted content.
• Separate browsing agents from privileged hosts using sandboxing, containers, or isolated VMs.
• Enforce explicit allowlists for executable tools and command parameters.
• Monitor for suspicious localhost WebSocket activity and unexpected child process creation.

Microsoft also noted that Defender provides detections relevant to this attack pattern.

Next steps

If your team is piloting AI agents, review whether those agents can both render untrusted web pages and access local services or tool execution paths. This combination should be treated as a critical architectural risk and addressed before broader deployment.