"This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package," Microsoft says.
AutoJack attack chain: three concrete weaknesses in AutoGen Studio
Microsoft described a multi-step vulnerability chain it has named AutoJack that existed in AutoGen Studio, the graphical interface for AutoGen — Microsoft’s open-source framework for building multi-agent AI systems. The company broke the chain into three specific weaknesses. First, the MCP WebSocket trusted connections that appeared to originate from localhost, allowing a browsing agent running on the same machine to be tricked into loading attacker-controlled JavaScript that seemed to come from a trusted local source. Second, AutoGen Studio's authentication middleware excluded the /api/mcp/* routes from authentication checks while the MCP WebSocket endpoint itself failed to implement authentication, leaving the endpoint accessible without credentials. Third, the MCP WebSocket accepted a base64-encoded server_params value from the URL and passed it to the process-launching code, enabling attackers to specify and execute arbitrary PowerShell or Bash commands, or launch executables.
How a realistic exploit would unfold
Microsoft laid out a plausible attack scenario. A developer’s AI agent visits a malicious webpage; JavaScript on that page runs in the agent’s browsing context and opens a WebSocket to AutoGen Studio’s local MCP endpoint. Because the WebSocket was trusted and unauthenticated, the page could deliver a payload that included a server_params value instructing AutoGen Studio to launch a command. The command would run with the privileges of the developer’s account. As a proof-of-concept, Microsoft demonstrated this by launching the Windows Calculator from the agent-driven payload.
Who was actually exposed: GitHub builds, not PyPI installs
Microsoft emphasised that exposure was limited. The affected code never shipped in a published package on the Python Package Index, so users who installed AutoGen Studio from PyPI were not exposed to the AutoJack weaknesses. The current published package, autogenstudio 0.4.2.2, does not contain the vulnerable code. Instead, the window of impact was confined to developers who built AutoGen Studio directly from the project’s main GitHub branch during the period between the MCP plugin landing and a subsequent hardening commit identified as b047730.
Fixes applied and operational guidance from Microsoft and the maintainer
Microsoft says the issue was identified and remediated before any PyPI release, meaning the vulnerable code was corrected during development. The project maintainer also issued operational guidance: deploy AutoGen Studio "strictly as a developer prototype in an isolated environment" that is not exposed to the internet, and do not run the project with an agent capable of browsing or executing arbitrary code on a machine that handles untrusted content. The maintainer further advised running AutoGen Studio under a low-privilege account in a sandboxed user profile or container so that any future agent-driven remote code execution would be contained to a development profile rather than a user’s daily-driver account.
What this means for developers, security teams, and end users
- Developers who build from the GitHub main branch: If you built AutoGen Studio from source during the specified window before commit b047730, you were the population Microsoft identified as affected; you should verify your local codebase and redeploy only patched commits or the published autogenstudio 0.4.2.2 package.
- Security teams in organizations using developer prototypes: The attack model shown — a malicious webpage triggering local WebSocket commands that spawn processes — reinforces Microsoft’s recommendation to isolate prototypes from internet-facing networks and to run them under least-privilege or containerized profiles.
- End users and PyPI consumers: If you installed AutoGen Studio from PyPI, Microsoft states you were not exposed, because the affected code never reached published packages.
AutoGen is a widely used open-source framework that lets agents collaborate, use tools, browse the web, execute code, interact with APIs, and connect to external systems; Microsoft notes the project has more than 59,000 stars and nearly 9,000 forks on GitHub. The company’s disclosure frames AutoJack as a development-time mistake that was corrected before release, but it also serves as a reminder that powerful agent capabilities — browsing, process launching, and tool use — can multiply risk when local endpoints trust or accept unauthenticated inputs.
Read the original report: https://www.bleepingcomputer.com/news/security/microsoft-fixes-autogen-studio-flaw-that-enabled-code-execution/
