AutoJack: How a single page can RCE the host running your AI agent

In this article Why we are looking at agent frameworks What is AutoGen Studio The AutoJack chain at a glance Anatomy of the chain Issue 1: Origin allowlist that the agent itself defeats Issue 2: Auth middleware that opts MCP out Issue 3: server_paramsfrom the URL is the command line Putting it together: a realistic scenario Fixes and hardening measures applied Mitigation and protection guidance How Microsoft helps secure agentic systems Microsoft Defender detections What this means for the broad