Loading story…
Microsoft disclosed AutoJack, an exploit chain in AutoGen Studio development code that allowed untrusted web content viewed by a local browsing agent to reach a localhost MCP WebSocket and launch arbitrary processes on the host. The attack combined three flaws: trust in localhost-based WebSocket origins, missing authentication on MCP WebSocket paths, and unsafe handling of attacker-controlled StdioServerParams supplied through the server_params query string, which was decoded into command execution.
Microsoft reported the issue to MSRC, and AutoGen maintainers hardened the upstream main branch in commit b047730 by moving parameter binding server-side and restoring authentication protections for MCP routes. Microsoft said the vulnerable MCP WebSocket surface was never shipped in a PyPI release, so users who installed AutoGen Studio from PyPI were not exposed to this specific chain, while warning that AI agent frameworks should not treat localhost as a trusted boundary when agents can browse untrusted content and interact with privileged local services.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
The AutoGen maintainers remediated the issue in the upstream main branch in commit b047730 by moving parameter binding server-side and restoring or tightening authentication coverage for MCP routes. The vulnerable MCP WebSocket surface had not been shipped in a PyPI release, so PyPI users were not exposed to this specific exploit chain.
After identifying the exploit chain, Microsoft reported the AutoJack issue to the Microsoft Security Response Center. This disclosure initiated remediation of the vulnerable AutoGen Studio development code.
Microsoft security researchers discovered an exploit chain they named AutoJack in AutoGen Studio development code that could let untrusted web content rendered by a local browsing agent reach a localhost MCP WebSocket and spawn arbitrary processes on the host. The chain relied on localhost-based WebSocket origin trust, missing authentication on MCP WebSocket paths, and unsafe execution of attacker-controlled StdioServerParams.
Microsoft researchers said the AutoJack issue affected AutoGen Studio pre-release PyPI builds 0.4.3.dev1 and 0.4.3.dev2, while stable release 0.4.2.2 was not affected because it lacked the MCP route. They also said the hardening in commit b047730 had not yet been released to PyPI at the time of reporting.
Microsoft publicly disclosed the AutoJack exploit chain and its security implications in a Microsoft Security Blog post. The disclosure also highlighted the broader lesson that localhost is not a trustworthy boundary when AI agents can browse untrusted content and interact with privileged local services.
In commit b047730, the AutoGen project deprecated FunctionTool in AutoGen Studio after identifying that FunctionTool instantiation used exec() on user-provided source code, including exposure through the /api/validate/ endpoint. The update removed FunctionTool creation and editing paths from the UI, added warnings recommending MCP Workbenches, and kept only limited compatibility for existing configurations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcemicrosoft.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two high-severity flaws affecting AI tooling: **CVE-2026-30950** in AutoGPT and **CVE-2026-59950** in the Model Context Protocol (MCP) Python SDK. In AutoGPT, an authenticated insecure direct object reference in the `/api/chat/sessions/{session_id}/assign-user` endpoint allowed any logged-in user to reassign another user’s chat session with a single `PATCH` request if the session ID was known. The bug affected `autogpt-platform-backend` versions `0.6.36` through `0.6.50` and was fixed in `0.6.51`; successful exploitation could expose full chat histories, pasted files, execution context, and credential-related metadata while also locking the victim out of the session.
Jul 20, 2026
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026
Researchers disclosed multiple vulnerabilities in enterprise AI agent frameworks that allowed attackers to bypass model authorization, trigger tools directly, and in some cases achieve **remote code execution**. Check Point reported 11 flaws across **LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK**, spanning insecure deserialization, **SSRF**, path traversal, and use-after-free. One critical issue in Microsoft Agent Framework let untrusted state data reach insecure checkpoint deserialization, enabling RCE; Microsoft fixed the bug and said no `CVE` was assigned because the product was not generally available. A separate disclosure described a cross-platform pattern dubbed **CoreBreak**, where execution layers in **Amazon Bedrock AgentCore, Google ADK, and Vercel AI SDK harnesses** accepted tool-call-shaped data without confirming that a legitimate model turn had authorized the action. AWS assigned **`CVE-2026-18830`** and automatically patched the managed service, Google fixed **`CVE-2026-18236`** in ADK for Python version **2.5.0**, and Vercel patched **`@ai-sdk/harness-codex` 1.0.29** and **`@ai-sdk/harness-opencode` 1.0.28**. Researchers said the findings show that the main risk lies in insecure agent orchestration and tool-execution logic, not prompt injection alone, with Google ADK also exposed to abuse that could write and run malicious Python code and leak API keys or cloud service account credentials.
Aug 6, 2026