AutoJack: one malicious web page can hijack an AI browser agent into full RCE via a privileged local service
Source Reddit Cybersecurity
Rated by Threat Radar
Data as of 20 Jun 2026, 16:09 UTC
What to do
AI-suggested
A fix is available in the AutoGen Studio GitHub main branch as of commit b047730, which hardens the MCP WebSocket handler by enforcing authentication and removing direct command execution from request parameters. However, this fix has not yet been released on PyPI. Users who installed the stable release 0.4.2.2 are not affected. Those who installed vulnerable pre-release versions (0.4.3.dev1 or 0.4.3.dev2) should update by pulling the fixed code from GitHub main at or after commit b047730. Until an official patched release is published, users should avoid running AutoGen Studio on the same machine as any browsing or code-execution agent that processes untrusted content. If co-location is necessary, isolate the components in separate containers or virtual machines and run AutoGen Studio under a low-privilege account to reduce risk.
Discussion
AutoJack is a vulnerability in Microsoft Research's AutoGen Studio AI browsing agent framework that allows a malicious web page to hijack the AI agent and achieve full remote code execution (RCE) on the host machine via a privileged local service. The issue arises from a combination of trusting localhost connections, lack of authentication on a WebSocket endpoint, and executing commands directly from requests. The vulnerability affects two pre-release versions of AutoGen Studio (0.4.3.dev1 and 0.4.3.dev2) but not the stable release 0.4.2.2. A fix has been committed to the GitHub main branch but has not yet been released on PyPI. Until an official release is available, users should avoid running AutoGen Studio alongside browsing agents on the same machine or isolate them in containers or VMs.
r/cybersecurity (opens in a new tab)u/TrustSig0 points0 comments
This is the kind of thing that keeps me up at night about the whole AI agent gold rush. The chain lets a single malicious page hijack a browsing agent and reach a privileged local service for full RCE. No creds, no extra clicks once the agent loads the page.
We spent twenty years drilling "don't trust the web page" into browsers, and now we hand an autonomous agent the keys and let it wander attacker-controlled content on its own. Prompt injection stops being a chatbot party trick and becomes a code execution problem the moment the agent can touch anything local.
Detection side is the part I actually care about: anything that watches what a privileged local service is being asked to do, and treats agent-originated requests as untrusted by default, seems like the only sane posture here.
https://thehackernews.com/2026/06/autojack-attack-lets-one-web-page.html