AutoJack: How a single page can RCE the host running your AI agent

The AutoJack exploit chain reveals how AI agents that browse untrusted web content while maintaining access to local services create a dangerous attack surface. The root cause lies in a combination of missing authentication on AutoGen Studio's MCP WebSocket interface, implicit trust of localhost traffic, and unsafe handling of parameters passed to local processes. This matters because AI agents are increasingly granted broad system permissions, and a single malicious webpage can pivot through the agent to execute arbitrary code on the host machine. As AI-assisted tooling becomes common in development environments, the assumption that 'local equals safe' must be abandoned. Developers and security teams must treat AI agent runtimes with the same scrutiny applied to any internet-facing service.