AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers disclosed “AutoJack,” an exploit chain that lets a local AI browsing agent open an attacker-controlled page which then abuses AutoGen Studio’s MCP WebSocket (present in two pre-release PyPI builds) to execute arbitrary commands as the AutoGen Studio user; a proof-of-concept triggers calc.exe, Microsoft reported no in-the-wild exploitation, and the maintainer patched the GitHub main branch but the fix is not yet released on PyPI—mitigations include not running AutoGen Studio alongside untrusted browsing agents or isolating them and pulling the patched source.