2026-06-18 · 2026-Q2
Microsoft AutoGen Studio "AutoJack" Drive-By Code Execution
PrimaryL6Identity / RunSecondaryL5Config
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
Microsoft AutoGen Studio built from the GitHub main branch after the MCP plugin was added and before commit b047730; published PyPI releases, including autogenstudio 0.4.2.2, were not affected
Impact
A malicious webpage tricks a localhost AutoGen Studio agent into executing arbitrary PowerShell, Bash, or executables with the developer's privileges; Microsoft demonstrated launching Calculator from a visited page
Root Cause
Three chained weaknesses: the MCP WebSocket trusted localhost connections, the auth middleware excluded `/api/mcp/*` routes, and the WebSocket accepted a base64 `server_params` value from the URL and passed it to process-launch code