Tia N.List

Reported by 2 outlets

AutoJack — Microsoft Security Research Demonstrates RCE Chain Against AI Agent Framework AutoGen Studio

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
0.50 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.01 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
malware.newsbleepingcomputer.com first seen 117d ago

Timeline

  1. original reporting

    AutoJack — Microsoft Security Research Demonstrates RCE Chain Against AI Agent Framework AutoGen Studio

    malware.news · 117d ago · June 19th, 2026

    Microsoft Defender Security Research disclosed AutoJack, a three-weakness exploit chain against AutoGen Studio (Microsoft Research's open-source multi-agent UI) that allows untrusted web content rendered by a browsing agent to reach a local MCP WebSocket and execute arbitrary commands on the host. The chain: (1) origin allowlist trusts localhost but the agent itself is localhost, (2) auth middleware explicitly opts out MCP WebSocket paths without implementing auth, (3) StdioServerParams from the URL is executed verbatim. Microsoft fixed the issue in the upstream main branch. The vulnerable MCP WebSocket surface was never included in a public PyPI release. Broader lesson: localhost is no longer a trust boundary when agents browse untrusted content and talk to privileged local services.

  2. update from bleepingcomputer.com

    AutoJack — Microsoft Ships Fix for AutoGen Studio MCP WebSocket RCE Chain

    bleepingcomputer.com · 113d ago · June 23rd, 2026

    Microsoft has remediated the AutoJack vulnerability chain in AutoGen Studio, three weeks after the initial disclosure. The fix, committed to the GitHub main branch, addresses three weaknesses: (1) MCP WebSocket trusted localhost origin without authentication, (2) authentication middleware excluded /api/mcp/* routes, and (3) base64-encoded server_params from the URL were passed verbatim to process-launching code. Microsoft emphasizes that the vulnerable code never shipped in a public PyPI release — only developers building from the GitHub main branch between the MCP plugin landing and the hardening commit were exposed. The latest PyPI package (autogenstudio 0.4.2.2) is clean. Microsoft recommends running AutoGen Studio in isolated, sandboxed environments. Context: Previously covered June 19 (initial disclosure of AutoJack chain by Microsoft Defender Security Research). New today: fix deployed, PyPI unaffected, containment guidance confirmed.

Source on GitHub