Introduction to AutoGen Studio and AutoJack
Microsoft's AutoGen Studio, a graphical component for the open-source AutoGen framework, has been found to contain a vulnerability chain dubbed AutoJack. This vulnerability allows attackers to manipulate an AI agent into executing arbitrary commands on its host system simply by visiting a malicious webpage.
AutoGen Studio is used for prototyping AI agents and is part of the popular AutoGen framework, which has over 59,000 stars and nearly 9,000 forks on GitHub. The framework enables developers to create AI agents that can collaborate, use tools, browse the web, execute code, interact with APIs, and connect to external systems.
AutoJack Details and Impact
According to Microsoft, the AutoJack attack is based on three separate weaknesses in AutoGen Studio. The first weakness is that the MCP WebSocket trusts connections originating from localhost, allowing a browsing agent running on the same machine to be tricked into loading attacker-controlled JavaScript that appears to come from a trusted local source.
The second weakness is that AutoGen Studio's authentication middleware excludes /api/mcp/* routes from authentication checks, while the MCP WebSocket endpoint fails to implement its own authentication, leaving it accessible without credentials.
The third weakness is that the MCP WebSocket accepts a base64-encoded server_params value from the URL and passes it to the process-launching code, allowing attackers to specify and execute arbitrary PowerShell, Bash commands, or executables.
Realistic Attack Scenario
In a realistic attack scenario presented by Microsoft, a malicious JavaScript executes on a page visited by a developer's AI agent, which opens a WebSocket connection to AutoGen Studio's local MCP endpoint. The payload instructs AutoGen Studio to launch an attacker-chosen command with the privileges of the developer's account.
Microsoft demonstrated the launch of Windows Calculator to show the effect of the vulnerability. However, it is essential to note that users installing AutoGen Studio from the Python Package Index (PyPI) were never exposed to the affected code, as the latest package, autogenstudio 0.4.2.2, does not contain the AutoJack weaknesses.
Mitigation and Recommendations
Microsoft recommends that users who install AutoGen Studio should deploy it strictly as a developer prototype in an isolated environment that is not exposed to the internet. Furthermore, the maintainer emphasizes that the project should not be run with an agent capable of browsing or executing arbitrary code on a machine with untrusted content.
Microsoft advises running AutoGen Studio under a low-privilege account in a sandboxed user profile or container so that any future agent-driven RCE is contained to a dev profile, not the daily-driver account.
Conclusion
The AutoJack vulnerability in AutoGen Studio highlights the importance of testing and securing AI systems. By understanding the weaknesses and taking steps to mitigate them, developers can ensure the security and integrity of their AI agents and the systems they interact with.
As Microsoft notes, this issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package. The exposure was limited to developers who built AutoGen Studio from the main GitHub branch during the window between the MCP plugin landing and the hardening commit.
Source: BleepingComputer