Microsoft fixes AutoGen Studio flaw that enabled code execution

A vulnerability chain dubbed AutoJack in Microsoft’s AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system simply by visiting a malicious webpage. AutoGen Studio is the graphical component for AutoGen, Microsoft’s open-source framework for building multi-agent AI systems. The framework allows developers to create AI agents that can collaborate with one another, use tools, browse the web, execute code, interact with APIs, and connect to external systems. The project is very popular, with more than 59,000 stars and nearly 9,000 forks on GitHub. Microsoft notes that AutoJack's impact was limited because the issue was addressed during development. "This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package," Microsoft says. "The exposure was limited to developers who built AutoGen Studio from the main GitHub branch during the window between the MCP plugin landing and the hardening commit.' Microsoft describes the AutoJack attack as being based on three separate weaknesses in AutoGen Studio: In a realistic attack scenario that Microsoft presented, a malicious JavaScript executes on a page visited by a developer’s AI agent, which opens a WebSocket connection to AutoGen Studio's local MCP endpoint. The payload instructs AutoGen Studio to launch an attacker-chosen command with the privileges of the developer’s account. To demonstr...