AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution Vulnerability

Microsoft made a similar localhost argument in its Semantic Kernel RCE research, tracked as CVE-2026-26030 and CVE-2026-25592. The issue is tracked as CVE-2026-26030, CVE-2026-25592. Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution.

The Vulnerability

A plain pip install autogenstudio pulls the current stable release, 0.4.2.2, the build Microsoft inspected, and it has no Model Context Protocol (MCP) route at all.

Further details indicate that what to do A plain pip install autogenstudio gives you 0.4.2.2, which has no MCP route, so you are not affected.

The flaw sits in AutoGen Studio, the open-source prototyping interface for Microsoft Research’s AutoGen multi-agent framework.

But the vulnerable handler did ship to PyPI, in two pre-release builds, 0.4.3.dev1 and 0.4.3.dev2.

“was never included in a PyPI release.”, Spokesperson

Technical Details

CVEs:

• CVE-2026-26030

• CVE-2026-25592

From a technical standpoint, the vulnerability presents several concerns:

Microsoft describes this as research, not an active campaign, and reported no exploitation in the wild.

Risk & Exposure

That is the basis for Microsoft’s statement that the vulnerable MCP WebSocket surface “was never included in a PyPI release.” It holds for the stable build. But the vulnerable handler did ship to PyPI, in two pre-release builds, 0.4.3.dev1 and 0.4.3.dev2. But a browsing agent running on the same box is localhost, so anything it loads inherits that localhost identity and passes the check.

Timeline

| Date | Event | |, , |, , -| | 0477 | There is still no PyPI build carrying the main-branch hardening for them; the fixed code is in GitHub main at commit … | | 0477 | Microsoft reported the behavior to the Microsoft Security Response Center, and the maintainers hardened the main bran… |

Patching & Remediation

1. There is still no PyPI build carrying the main-branch hardening for them; the fixed code is in GitHub main at commit b047730.

2. First, the socket trusted localhost, a check meant to block a normal browser pointed at a malicious site.

3. It never did, so the socket accepted unauthenticated connections regardless of the configured auth mode.

4. The fixed handler no longer reads the command from the URL; parameters are stored server-side behind a one-time session ID, and unknown IDs are refused.

5. If you installed a pre-release, you have the vulnerable handler and no patched PyPI build to move to.

6. The AutoGen Studio bugs are patched in the source.

Analysis

This disclosure adds to a growing pattern of significant vulnerabilities affecting enterprise infrastructure. As AI tooling proliferates, security teams face expanding attack surfaces tied to model inference and data pipelines.

Security teams should monitor vendor advisories and threat intelligence sources closely for additional context or updates. Organizations with mature security programs are advised to incorporate this intelligence into their regular risk assessments and prioritize response activities based on exposure and asset criticality. For environments where immediate remediation is not feasible, compensating controls such as network segmentation, enhanced monitoring, and access restrictions should be evaluated. Security leadership should communicate relevant details to operational teams and ensure that incident response capabilities are prepared if exploitation is observed in the wild.

Sources

1. https://nvd.nist.gov/vuln/detail/CVE-2026-26030
2. https://nvd.nist.gov/vuln/detail/CVE-2026-25592
3. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26030
4. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25592