Microsoft AI agent exploit enables remote code execution

Security researchers at Microsoft have disclosed a critical exploit chain, dubbed "AutoJack," that can turn an AI browsing agent into a vehicle for remote code execution on a developer's machine. The technique targets AutoGen Studio, an open-source prototyping interface for multi-agent AI systems developed by Microsoft Research.

The exploit chain combines three separate weaknesses in AutoGen Studio's Model Context Protocol (MCP) WebSocket implementation. First, the service accepted connections only from localhost, a check that a local AI agent inherently satisfies. Second, authentication middleware skipped the MCP paths, leaving them open without requiring credentials. Third, the vulnerable endpoint accepted a command directly from a request parameter and executed it without any allowlist or validation.

In a proof-of-concept demonstration, a researcher instructed a "Web Content Summarizer" agent to visit a malicious webpage. JavaScript on that page then connected to the local AutoGen Studio service and successfully launched the calculator application on the developer's desktop, executed by the AutoGen Studio process itself. The attack requires no user interaction beyond the...