2026-06-18 · 2026-Q2
Microsoft AutoGen Studio "AutoJack" Drive-By Code Execution
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Microsoft AutoGen Studio built from the GitHub main branch after the MCP plugin was added and before commit b047730; published PyPI releases, including autogenstudio 0.4.2.2, were not affected
Impact
A malicious webpage tricks a localhost AutoGen Studio agent into executing arbitrary PowerShell, Bash, or executables with the developer's privileges; Microsoft demonstrated launching Calculator from a visited page
Root cause
Three chained weaknesses: the MCP WebSocket trusted localhost connections, the auth middleware excluded `/api/mcp/*` routes, and the WebSocket accepted a base64 `server_params` value from the URL and passed it to process-launch code
Sources
Catalog
Cite this: AgentProv incident record: Microsoft AutoGen Studio "AutoJack" Drive-By Code Execution (2026-06-18). https://agentprov.com/incidents/2026-06-18-microsoft-autogen-studio-autojack-drive-by-code-execution
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run