AutoJack research exposes a browsing-agent path to local execution

The June report says the affected surface never shipped in a PyPI release.

Capvise MediaEvent 19 Jun 2026Published 15 Oct 20261 min read

Dell Precision T3500 workstation being used for research at the Institute for Phototonics and Advanced Sensing (IPAS). The photo subject is IPAS Researcher Roman Kostecki, who is visualizing output from a mathematical model. — Photo: Context photograph: Dell Precision T3500 workstation being used for research at the Institute for Phototonics and Advanced Sensing (IPAS). The photo subject is IPAS Researcher Roman Kostecki, who is visualizing output from a mathematical. Source context: Scientist working with personal computer, 2013 (Dell Precision T3500 Workstation).jpeg. It is illustrative and does not depict the specific incident in this story. Credit: Flickr user ipasadelaide (artist: Jennie Groom) · CC BY 2.0 · Resized for web delivery

A webpage reached a local control surface

Microsoft researchers described AutoJack in June, an exploit chain involving AutoGen Studio’s development interface. The chain connected untrusted content read by a browsing agent with a privileged local MCP WebSocket, allowing processes to be started on the host.

The release boundary matters

The researchers reported the behaviour to Microsoft’s security response team, and maintainers hardened the upstream development branch. Crucially, the affected WebSocket surface was not included in a PyPI release, so the report says users installing AutoGen Studio from PyPI were not exposed to this particular chain. The finding concerns a development-stage path. Its broader relevance is the authority a local control service grants to content that an agent merely browses.