[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8DtYDjXPaNtdPWAzBfVdQuByeIS04O7aWeC9hS7JyqE":3},{"article":4,"iocs":53,"watch_terms":60,"solutions":61,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"62b5f590-0304-4acd-a74a-824276e49d7e","AutoJack: How a single page can RCE the host running your AI agent","autojack-how-a-single-page-can-rce-the-host-running-your-ai-agent-90bc6b","AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted content and access local services, traditional boundaries like localhost are no longer secure. The post AutoJack: How a single page can RCE the host running your AI agent appeared first on Microsoft Security Blog.","A new exploit chain called AutoJack demonstrates how a malicious webpage can compromise an AI browsing agent, turning it into a remote code execution vector on the host machine. By exploiting trust in localhost, missing authentication, and unsafe parameter handling within AutoGen Studio's MCP WebSocket, attackers can trigger arbitrary process execution. While the vulnerability was patched before release and affects only specific development setups, it highlights the broader risk of AI agents browsing untrusted content while having access to local services.","AutoGen Studio AI agent can be RCE'd by a malicious webpage via localhost trust abuse.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F18\u002Fautojack-single-page-rce-host-running-ai-agent\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002FMS_Actional-Insights_Adversarial-AI.jpg","2026-06-19T00:17:54+00:00","2026-06-19T04:00:04.253479+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"AutoGen Studio","product",{"name":21,"type":19},"AutoGen",{"name":23,"type":24},"AI agents","technology",{"name":26,"type":24},"WebSocket",{"name":28,"type":29},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"url","http:\u002F\u002F127.0.0.1","Origin allowlist trusts localhost for MCP WebSocket connections.",{"type":55,"value":59,"context":57},"http:\u002F\u002Flocalhost",[28,18,21],{"controls":62,"vendors":149},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":93,"name":94,"problem":95,"products":96},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":47,"name":122,"problem":123,"products":124},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[150],{"slug":151,"name":28,"logo_path":152,"roles":153},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[154,155],"reported_by","affected",{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":171},"ai-browsing-agents-can-become-rce-vectors-via-localhost-trust-abuse","AI Browsing Agents Can Become RCE Vectors via Localhost Trust Abuse","The AutoJack exploit chain reveals how AI agents that browse untrusted web content while maintaining access to local services create a dangerous attack surface. The root cause lies in a combination of missing authentication on AutoGen Studio's MCP WebSocket interface, implicit trust of localhost traffic, and unsafe handling of parameters passed to local processes. This matters because AI agents are increasingly granted broad system permissions, and a single malicious webpage can pivot through the agent to execute arbitrary code on the host machine. As AI-assisted tooling becomes common in development environments, the assumption that 'local equals safe' must be abandoned. Developers and security teams must treat AI agent runtimes with the same scrutiny applied to any internet-facing service.",[161,162,163,164,165,166,167,168,169,170],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SI-10: Information Input Validation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","OWASP ASVS V5: Validation, Sanitization and Encoding","OWASP ASVS V14: Configuration",{}]