An exploit chain known as AutoJack in Microsoft's graphical interface called AutoGen Studio, used for prototyping artificial intelligence agents, could allow an attacker to cause an agent to perform arbitrary commands against the host operating system, by simply having the agent visit a malicious website.
AutoGen Studio is the graphical part of the AutoGen application programming interface (API), which is the graphical portion of Microsoft's open-source multi-agent artificial intelligence framework, AutoGen. Developers are able to develop multi-agent artificial intelligence using AutoGen; these multi-agent AI systems may work together, use other applications, surf the web, write code, communicate with APIs, and link to external computer systems.
The project has gained popularity. It has been starred over 59,000 times and forked nearly 9,000 times on GitHub. Microsoft said that the AutoJack exploits were limited, since the issues were resolved prior to any PyPI releases.
"This issue was identified and remedied prior to any PyPI publication," Microsoft said. "Thus, no version of this problematic code was ever included in any published package."
"Further, the exposure was confined to those developers who had constructed AutoGen Studio from the main GitHub branch between when the MCP plugin landed and when the hardening commit landed."
Details of the AutoJack vulnerabilities
- The MCP WebSocket will trust all incoming connections from localhost. Thus, if there exists a browser-based agent running upon the same device as the target workstation and that agent visits a malicious webpage created by an attacker, then that browser-based agent can load attacker-created JavaScript onto the target workstation. Since the browser-based agent views that JavaScript as coming from a local source that appears to be trusted, it will execute it.
- Although the AutoGen Studio API includes authentication middleware that excludes /api/mcp/* route endpoints from authentication checks, the MCP WebSocket endpoint does not include its own authentication mechanism. Therefore, an attacker can access the MCP WebSocket endpoint without providing credentials.
- The MCP WebSocket endpoint accepts a base64-encoded string containing parameters for server_params from the URL path of the request. Those values are passed to the code responsible for launching processes and thus enable attackers to specify and execute arbitrary shell commands such as PowerShell/Bash commands or executable files.
Microsoft also provided an example of what would happen if a legitimate JavaScript script ran upon a webpage visited by an AI agent developed by a developer. The AI agent connects via WebSockets to AutoGen Studio's local MCP endpoint. The payload tells AutoGen Studio to launch a command chosen by the attacker with the privileges associated with the developer's account. To illustrate this concept, Microsoft executed Windows Calculator.
As mentioned previously, users installing AutoGen Studio from the Python Package Index (PyPI) were not vulnerable to the AutoJack issues. As per the most recent released package, autogenstudio 0.4.2.2, none of the packages have the weaknesses related to AutoJack.
However, developers creating AutoGen Studio directly from GitHub during a specific time frame prior to commit b047730 did experience a brief vulnerability.
Microsoft provides recommendations for those developing and utilizing AutoGen Studio. They recommend that users who intend to deploy AutoGen Studio only do so strictly as a developer prototype within an isolated environment that is not connected to the internet.
Additionally, Microsoft suggests that developers maintain their projects under a low-privilege account in either a sandboxed user profile or a container to prevent any potential remote code execution (RCE) exploits initiated by agents accessing a non-trusted area of their daily driver account.
"Run AutoGen Studio under a low-privilege account in a sandboxed user profile or container so that any future agent-driven RCE is contained to a dev profile and not your daily-driver account," advised Microsoft.
