AutoJack How a Single Page Can RCE the Host Running Your AI ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://microsoft.com/en-us/security/blog/2026/06/18/autojack-single-page-rce-host-running-ai-agent
• Blog Title: AutoJack: How a Single Page Can RCE the Host Running Your AI Agent
• Suggested Section: AI Security -> AI MCP Security; optionally cross-reference Pentesting Web -> WebSocket Attacks and Command Injection

🎯 Content Summary

AutoJack is a research exploit chain found by Microsoft in a development build of AutoGen Studio, the developer UI for AutoGen multi-agent systems. The chain shows how attacker-controlled web content rendered by a local browsing agent can cross the localhost trust boundary, connect to AutoGen Studio's local Model Context Protocol (MCP) WebSocket, and cause the AutoGen Studio process to spawn arbitrary commands on the host.🔧 Technical Details

Agent-assisted localhost WebSocket hijacking: Localhost-only Origin checks are insufficient when a browser-capable AI agent runs on the same machine as a privileged local service. If the agent renders attacker-controlled HTML or JavaScript, that content can attempt WebSocket or HTTP requests to localhost and abuse the agent as a confused deputy. The reusable pattern is to identify local control planes protected mainly by loopback assumptions, then steer a local browsing agent into loading content that reaches those services.

WebSocket authentication bypass through middleware exclusions: If an application's global authentication middleware skips WebSocket-like paths such as /api/ws or /api/mcp, the WebSocket handler must perform its own authentication during handshake or accept time. If the handler does not do so, the route remains unauthenticated even when the rest of the REST API is protected by OAu...

🤖 Agent Actions

Using the repo directly; I’ll inspect AI/MCP-related docs first, then place the new technique where it best fits.
Done — I updated:

• src/AI/AI-MCP-Servers.md

Added a new subsection covering the reusable agent-assisted localhost MCP hijacking / AutoJack pattern, including:

• why localhost/Origin checks fail with local browsing agents
• the auth-skip/WebSocket trust issue
• StdioServerParams-style process spawn abuse
• audit checks
• durable fixes

Also added the Microsoft blog URL to the file’s ## References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://microsoft.com/en-us/security/blog/2026/06/18/autojack-single-page-rce-host-running-ai-agent

Content Categories: Based on the analysis, this content was categorized under "AI Security -> AI MCP Security; optionally cross-reference Pentesting Web -> WebSocket Attacks and Command Injection".

Repository Maintenance:

• MD Files Formatting: 977 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0