Microsoft fixed a vulnerability chain in AutoGen Studio that could let a malicious webpage trick an AI agent into running commands on the computer hosting the tool. The issue, dubbed AutoJack, affected AutoGen Studio builds made directly from the GitHub main branch before hardening commit b047730; Microsoft said it never shipped in a PyPI release. The chain involved unauthenticated MCP WebSocket access, localhost trust bypass, and attacker-controlled server_params that could launch PowerShell, Bash, or other executables.
Why it matters: Developers experimenting with AI agents could have exposed their own workstation to remote command execution just by having a browsing-capable agent visit hostile content. Anyone who built AutoGen Studio from GitHub during the affected window should update and run it only in an isolated, low-privilege environment.
Bill Toulas
2026.06.22
100% relevant
This article establishes a distinct vulnerability-and-fix event in Microsoft AutoGen Studio, with concrete technical details, affected scope, and remediation guidance not covered by an existing tracked story.
← Back to all stories