{"schema_version":"0.10.0","id":"LR-2026-0589","record_version":1,"title":"AutoJack flaw in Microsoft AutoGen Studio enabled code execution, fixed during development","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: BleepingComputer · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: BleepingComputer · subject to change"}]},"sources_hash":"57431d0bff77214a582b5614d23be512a9b9ad9b5ad0a77bbf6e09ba79e19fe9"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-22","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Microsoft's AutoGen Studio, a graphical interface for prototyping AI agents, contained a vulnerability chain named AutoJack. Its MCP WebSocket trusted localhost connections, lacked its own authentication, and passed a base64-encoded server_params value to process-launching code. A malicious webpage visited by a browsing agent on the same machine could make the agent run attacker-chosen commands with the developer's privileges. Microsoft identified and remediated the issue before any PyPI release, so the affected code never shipped in a published package. Developers building AutoGen directly from GitHub during a limited window before commit b047730 were impacted for a short period. Microsoft said the impact was limited because the issue was addressed during development, and it recommends running AutoGen Studio as a low-privilege developer prototype in an isolated environment.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Issue identified and remediated before any PyPI release","precursor_events":null,"primary_risk":"RK08"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test: minor (contained to one deployer or one evaluation, no third party touched). Exposure limited to developers building from GitHub within a bounded window; the PyPI package never contained the flaw.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/microsoft-fixes-autogen-studio-flaw-that-enabled-code-execution/","publisher":"BleepingComputer","date":"2026-06-22","type":"press","title":"Microsoft fixes AutoGen Studio flaw that enabled code execution - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.developer":"C","event.incident_class":"C","event.remediation":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"AutoGen Studio is the graphical component for AutoGen, Microsoft’s open-source framework for building multi-agent AI systems."}],"event.incident_class":[{"source_index":0,"quote":"A vulnerability chain dubbed AutoJack in Microsoft’s AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system simply by visiting a malicious webpage."}],"event.remediation":[{"source_index":0,"quote":"\"This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package,\" Microsoft says."}],"impact.severity":[{"source_index":0,"quote":"The exposure was limited to developers who built AutoGen Studio from the main GitHub branch during the window between the MCP plugin landing and the hardening commit."}],"impact.severity_because":[{"source_index":0,"quote":"The exposure was limited to developers who built AutoGen Studio from the main GitHub branch during the window between the MCP plugin landing and the hardening commit."}],"event.summary":[{"source_index":0,"quote":"A vulnerability chain dubbed AutoJack in Microsoft’s AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system simply by visiting a malicious webpage."},{"source_index":0,"quote":"AutoGen Studio's authentication middleware excludes /api/mcp/* routes from authentication checks, while the MCP WebSocket endpoint fails to implement its own authentication, leaving it accessible without credentials"},{"source_index":0,"quote":"The MCP WebSocket accepts a base64-encoded server_params value from the URL and passes it to the process-launching code, allowing attackers to specify and execute arbitrary PowerShell, Bash commands, or executables."},{"source_index":0,"quote":"\"This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package,\" Microsoft says."},{"source_index":0,"quote":"However, developers building AutoGen directly from GitHub during a limited window before commit b047730 were impacted for a short period."},{"source_index":0,"quote":"Microsoft notes that AutoJack's impact was limited because the issue was addressed during development."},{"source_index":0,"quote":"\"Run AutoGen Studio under a low-privilege account in a sandboxed user profile or container so that any future agent-driven RCE is contained to a dev profile, not your daily-driver account,\" advises Microsoft."}]},"notes_on_gaps":"The source is a single press article with no model name, version, deployment context, lifecycle stage, dates, detection method, trigger, or counts of affected parties, so those fields are omitted. The article's own date is not stated in its body, so no disclosure date is recorded. No exploitation in the wild is reported. Judgements made: agent_involved is true because a browsing agent is the attack path; failure_class and trigger are omitted because the source does not describe the agent's own misbehaviour or state a cause; near_miss is true based on the pre-release fix and limited exposure; severity minor is inferred from the bounded exposure window and PyPI package being unaffected, though no third party count is stated; the root cause is classed as guardrail because the failure is missing authentication; the J2 control link and controls_added are inferred from the authentication weakness and the fix, as the source does not list the exact change; the A1 'missing' outcome is inferred from the privileged execution described. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: BleepingComputer · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"The issue was identified and remediated during development, before any PyPI release.","quote":"\"This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package,\" Microsoft says.","source_index":0,"grade":"C"},{"step":"done","text":"Microsoft said the impact was limited because the issue was fixed during development.","quote":"Microsoft notes that AutoJack's impact was limited because the issue was addressed during development.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/microsoft-fixes-autogen-studio-flaw-that-enabled-code-execution/"]},"analysis":{"sections":{"timeline":[{"text":"Issue identified and remediated before any PyPI release.","quote":"\"This issue was identified and remediated before any PyPI release, so the affected code never shipped in a published package,\" Microsoft says.","source_index":0,"when":null},{"text":"The latest PyPI package, autogenstudio 0.4.2.2, does not contain the AutoJack weaknesses.","quote":"The latest current package, autogenstudio 0.4.2.2, does not contain the AutoJack weaknesses.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/microsoft-fixes-autogen-studio-flaw-that-enabled-code-execution/"]}}