A critical exploit chain dubbed AutoJack has been discovered in Microsoft's AutoGen Studio AI browsing agent framework, allowing a single malicious web page to hijack the AI agent and execute arbitrary code on the host machine. The vulnerability, which affects two pre-release versions of AutoGen Studio (0.4.3.dev1 and 0.4.3.dev2), was reported by Microsoft researchers and has since been patched in the main branch.

What Happened

The AutoJack exploit chain leverages three weaknesses in the Model Context Protocol (MCP) WebSocket handler: trusting localhost connections, missing authentication on the MCP WebSocket endpoint, and executing commands directly from request parameters without allowlisting. This enables a malicious web page loaded by the AI agent to run arbitrary commands on the host with the privileges of the AutoGen Studio process.

The vulnerability was discovered in two pre-release versions of AutoGen Studio (0.4.3.dev1 and 0.4.3.dev2), but not in the stable 0.4.2.2 release. Microsoft researchers reported the issue, and the maintainers hardened the main branch with commit b047730, introducing server-side parameter storage with one-time session IDs and enforcing authentication on MCP routes.

Background and Context

AutoGen Studio is an open-source AI multi-agent framework developed by Microsoft Research. It allows developers to create and manage multiple agents that can interact with each other and the environment. The framework includes a WebSocket handler for communication between agents, which is vulnerable to the AutoJack exploit chain.

The vulnerability arises from trusting localhost connections, which allows an AI browsing agent running locally to bypass origin checks. This is particularly concerning in environments where developers run AutoGen Studio alongside browsing agents on the same machine or isolate them in containers or VMs.

Why it Matters to the Industry

The AutoJack exploit chain has significant implications for adult-industry platforms and operators that rely on AI-powered tools and services. The vulnerability allows an attacker controlling a malicious web page to hijack an AI browsing agent running locally and execute arbitrary code on the host system with the privileges of the AutoGen Studio process.

This could potentially lead to full remote code execution and system compromise, highlighting the need for robust security measures in adult-industry platforms. The vulnerability is limited to environments where the vulnerable pre-release versions of AutoGen Studio are installed, but it serves as a reminder of the importance of staying up-to-date with the latest security patches and updates.

What Comes Next

Microsoft has patched the vulnerability in the main branch, and users who installed vulnerable pre-releases should update to the fixed GitHub main branch or isolate affected components until an official patch is released. The maintainers have also introduced server-side parameter storage with one-time session IDs and enforced authentication on MCP routes.

The discovery of the AutoJack exploit chain serves as a reminder of the importance of robust security measures in AI-powered tools and services. Adult-industry platforms and operators should prioritize staying up-to-date with the latest security patches and updates to prevent similar vulnerabilities in the future.

Key Facts

  • The AutoJack exploit chain affects two pre-release versions of AutoGen Studio (0.4.3.dev1 and 0.4.3.dev2).
  • The vulnerability allows a malicious web page to hijack the AI agent and execute arbitrary code on the host machine.
  • Microsoft researchers reported the issue, and the maintainers hardened the main branch with commit b047730.
  • The stable 0.4.2.2 release is not affected by the vulnerability.
  • Users who installed vulnerable pre-releases should update to the fixed GitHub main branch or isolate affected components until an official patch is released.