Executive Summary
Microsoft security research identified 'AutoJack,' a high-impact exploit chain in the AutoGen Studio prototyping framework. The vulnerability allows an attacker to achieve Remote Code Execution (RCE) on a host by tricking an AI agent into browsing a malicious webpage. Because the agent runs locally, its requests to the Model Context Protocol (MCP) WebSocket are treated as trusted localhost traffic, effectively dissolving the loopback trust boundary.
The technical root cause involves three combined weaknesses: a missing origin validation that erroneously trusts local agents (CWE-1385), authentication middleware that opted out of protecting MCP paths (CWE-306), and a command injection vulnerability where WebSocket parameters were executed verbatim as OS commands (CWE-78). No user interaction is required beyond the agent rendering the attacker's page.
While the issue was remediated in the upstream main branch (commit b047730) before shipping to the Python Package Index (PyPI), it serves as a critical warning for the AI agent ecosystem. Organizations utilizing agent frameworks must recognize that agents with web-browsing capabilities can be manipulated into attacking privileged local services running on the same host.