AIDEFEND in Action AIA-0042 Validated Research Published: Jul 6, 2026

AutoJack Turns Localhost Agent Control Planes Into a Browser-RCE Lesson

Microsoft's AutoJack research showed how untrusted web content rendered by a browsing agent could reach a local AutoGen Studio (Microsoft AutoGen's local interface for building and managing agents) MCP WebSocket route, reach a WebSocket handler with no Origin or authentication check, and supply server parameters that spawn arbitrary processes. Microsoft addressed the issue before PyPI release, but the architecture lesson is broader: localhost is not a security boundary for agent control planes.

Remote Code ExecutionPermission BypassRuntime IsolationMCP SecurityAgentic AI
7 applicable AIDEFEND defenses
Source: AutoJack: Single Page RCE Host Running AI Agent 
Author: Microsoft Defender Security Research Team
Original article: Jun 18, 2026

Threat Analysis

  • The malicious input is ordinary web content. A browsing agent renders an attacker-controlled page while the local agent framework is running.
  • The browser can reach localhost. The page opens a WebSocket to the local MCP route, so loopback service exposure becomes part of the attack surface.
  • The MCP WebSocket handler lacked its own checks. The affected source accepts the connection without checking its Origin or invoking WebSocket authentication. The application's authentication middleware handles HTTP; its skip list does not exempt /api/mcp. Reaching localhost does not change the attacker page's Origin.
  • server_params crosses into process creation. Base64-decoded parameters supply command and args, turning a browser page into host code execution.
  • The lesson is control-plane isolation. Agent admin, MCP, browser, and command-execution surfaces must be authenticated, authorized, allowlisted, and sandboxed even when they bind to localhost.
  • The patch changes how launch parameters enter the route. Commit b047730 registers parameters server-side through POST /api/mcp/ws/connect and lets the WebSocket consume a one-time session ID. HTTP authentication still depends on the deployment configuration; this does not establish universal authentication or network isolation.

Applicable AIDEFEND Defenses (7)

AID-H-021.004
Control-Plane & Oversight-Surface Isolation
Very High
Control-plane and oversight-surface isolation prevents the agent runtime or browser task from reading or changing the local control plane that can start tools or processes.
AID-H-034.001
MCP Server Deployment Profile, Transport & Exposure Baseline
High
Use the G003 safe stdio launcher at the MCP-server registration boundary: select the executable and server script from trusted deployment configuration, pass only fixed approved arguments, set shell:false and a minimal environment, and drop child privileges. Reject caller-supplied command, args and env instead of handing server_params to stdio_client. The published fixed-launcher method fits this boundary; every registration and alternate launcher path must be independently tested.
AID-H-019.003
Browser Runtime Admission & Sanitized Observation Export Gate
High
Admit the browsing task only after current context, sandbox and externally enforced egress receipts bind the exact task, browser build and policy. Reject missing, stale or mismatched evidence and release only bounded sanitized observations. I-001.004 separately owns the actual loopback/WebSocket network denial; browser route hooks or a caller-declared receipt cannot substitute for that packet-path proof.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
For any affected AutoGen Studio source deployment, the remediation owner must identify the vulnerable running version, rebuild or replace it with the corrected route, stage the rollout, and verify that no affected instance remains. This owns software remediation; the separate closure control owns independent exploit replay.
AID-I-001.003
Ephemeral Single-Use Sandboxes for Tools
High
Ephemeral single-use sandboxes contain any high-risk command handler that remains available after validation.
AID-E-004
Incident Exploit-Path Closure Verification
High
After the corrected AutoGen Studio build and control changes are deployed, independently replay the attacker-page-to-localhost WebSocket path and verify that authentication, origin policy, and process-spawn denial close the exact route across the incident-scoped population. This control verifies closure; it does not ship the fix.
AID-I-001.004
Sandbox Network Egress Restrictions
High
Enforce a named default-deny browser-sandbox egress policy outside Chromium/Playwright and bind it to the exact sandbox, generation and task. Deny loopback/private-address and direct-socket bypass paths, including page-created WebSockets to the host MCP service. G002 requires a real enforcement adapter, authenticated binding/flow receipts and probes from the exact browser runtime; its illustrative binding code alone is not network enforcement.

What Defenders Should Do Now

  • Inventory agent frameworks that expose localhost HTTP or WebSocket control planes, including MCP routes and developer-only endpoints.
  • Require authentication, origin validation, and authorization on every local route, including WebSocket upgrades.
  • Deny arbitrary command, browser, and filesystem tool startup from request parameters; use allowlisted execution profiles instead.
  • Run browsing agents in isolated browser contexts that cannot access local control planes unless policy explicitly allows it.
  • Add regression tests that load attacker-controlled pages and attempt localhost WebSocket, fetch, and redirect access to agent services.

Conclusion

AutoJack connects untrusted web content, an agent browser, a local MCP launch route and host process creation. Verify authentication and Origin checks for the actual WebSocket transport, authorize a bounded launch profile, and enforce browser egress outside the browser process. The admission gate checks evidence of these boundaries; it does not create them. Independently replay the complete route after deploying the fix.

Last updated: