Microsoft Researchers Uncover AutoJack Attack, Exposing AI Browsing Agents to Remote Code Execution

A recent discovery by Microsoft researchers has shed light on a significant vulnerability in AI browsing agents, which can be exploited to execute remote code on a host machine. The exploit chain, dubbed AutoJack, targets the AutoGen Studio open-source prototyping interface, specifically the Model Context Protocol (MCP) WebSocket surface. By loading a malicious web page, an attacker can bypass security checks and execute arbitrary code on the host machine, without requiring credentials or user interaction. The vulnerability arises from three weaknesses in the MCP WebSocket: trusting localhost, skipping authentication middleware, and accepting unauthenticated connections.

Microsoft has reported that the vulnerable code was inadvertently shipped in two pre-release builds, 0. 4. 3. dev1 and 0.

4. 3. dev2, but not in the stable release. To mitigate the risk, users who installed pre-releases should pull the fixed code from GitHub main at or after commit b047730.

Meanwhile, users with plain installations are not affected. Microsoft emphasizes that this pattern of vulnerability may be present in other agent frameworks, highlighting the importance of authenticating the control plane, keeping process execution behind an allowlist, and assigning a unique identity to agents. As the use of AI browsing agents continues to grow, it is essential to address these security concerns to prevent potential exploits.

Source: The Hackers News