Microsoft has laid out a new attack technique called AutoJack. In its write-up, the company shows how a malicious webpage could use a web-enabled agent as a go-between, reach a local Model Context Protocol (MCP) service, and kick off arbitrary processes on your computer without asking for any extra clicks.
What this comes down to is a confused-deputy problem. Once a web-enabled agent can browse the web and also talk to privileged local services, localhost isn’t a boundary you can safely assume will protect you.
Microsoft says the proof of concept relied on three separate issues lining up at once: inherited localhost identity that slipped past an origin allowlist, MCP WebSocket endpoints with no authentication, and URL-based server_params that were decoded straight into process-launching logic, with no executable allowlist in place. Put together, that gave the webpage a way to tell the local service to run code. Microsoft also says this wasn’t a browser bug. It was the agent’s trusted position being used against it.
If you’re building or deploying web-enabled agents, this should get your attention, because the same pattern could easily turn up in other frameworks that connect web access with local tools or developer services.
Microsoft says the vulnerable AutoGen Studio MCP code only appeared in development builds and was fixed before anything reached a public PyPI release. Even so, it still points to the broader risks around prompt injection, agent hijacking, data exposure, and the need for zero-trust controls, sandboxing, and runtime monitoring. If you want the full breakdown, Microsoft’s research goes into the details.
Author: Anthony John Padilla
{
"social": {
"email": "content.reviewer90@ext.softonic.com",
"facebook": "",
"twitter": "",
"linkedin": "https:\/\/www.linkedin.com\/in\/anthony-padilla-330a04299\/"
},
"ja-JP": "",
"de-DE": "Anthony Padilla ist ein auf den Philippinen ansässiger Schriftsteller mit Erfahrung in redaktionellen, digitalen und markenorientierten Inhalten. Seine Arbeit konzentriert sich darauf, komplexe Ideen in klare, verständliche Texte umzuwandeln.",
"en-US": "Anthony Padilla is a Philippines-based writer with experience across editorial, digital, and brand-focused content. His work centers on translating complex ideas into clear, accessible copy, with a strong emphasis on structure, accuracy, and user-focused communication. He has contributed to long-form articles, product and platform copy, and marketing-led editorial pieces.",
"es-ES": "Anthony Padilla es un escritor con base en Filipinas con experiencia en contenido editorial, digital y enfocado en marca. Su trabajo se centra en traducir ideas complejas en textos claros y accesibles.",
"fr-FR": "Anthony Padilla est un écrivain basé aux Philippines ayant de l'expérience dans le contenu éditorial, numérique et axé sur la marque. Son travail consiste à traduire des idées complexes en textes clairs et accessibles.",
"it-IT": "Anthony Padilla è uno scrittore con base nelle Filippine con esperienza in contenuti editoriali, digitali e focalizzati sul brand. Il suo lavoro si concentra sulla traduzione di idee complesse in testi chiari e accessibili.",
"nl-NL": "Anthony Padilla is een schrijver gevestigd op de Filipijnen met ervaring in redactionele, digitale en merkgerichte content. Zijn werk richt zich op het vertalen van complexe ideeën naar helder, begrijpelijke teksten.",
"pl-PL": "Anthony Padilla to pisarz mieszkający na Filipinach z doświadczeniem w tworzeniu treści redakcyjnych, cyfrowych i skoncentrowanych na marce. Jego prace skupiają się na przekształcaniu skomplikowanych idei w jasne, zrozumiałe teksty.",
"pt-BR": "Anthony Padilla é um escritor baseado nas Filipinas com experiência em conteúdo editorial, digital e focado em marca. Seu trabalho se concentra em traduzir ideias complexas em textos claros e acessíveis."
}
View all posts by Anthony John Padilla
