Cases › security breach › LR-2026-0589
AutoJack flaw in Microsoft AutoGen Studio enabled code execution, fixed during development
Preliminary Why: 1 report: BleepingComputer · subject to change · 1 independent report
Status: fix reported
No source states: loss or records, agent tool, could do, deployer, industry.
Severity minor: Test: minor (contained to one deployer or one evaluation, no third party touched). Exposure limited to developers building from GitHub within a bounded window; the PyPI package never contained the flaw.
Microsoft's AutoGen Studio, a graphical interface for prototyping AI agents, contained a vulnerability chain named AutoJack. Its MCP WebSocket trusted localhost connections, lacked its own authentication, and passed a base64-encoded server_params value to process-launching code. A malicious webpage visited by a browsing agent on the same machine could make the agent run attacker-chosen commands with the developer's privileges. Microsoft identified and remediated the issue before any PyPI release, so the affected code never shipped in a published package. Developers building AutoGen directly from GitHub during a limited window before commit b047730 were impacted for a short period. Microsoft said the impact was limited because the issue was addressed during development, and it recommends running AutoGen Studio as a low-privilege developer prototype in an isolated environment.
What happened
What was done
“Issue identified and remediated before any PyPI release”
No later incident for Microsoft under this risk on record.
Risks
Read from the sources; not yet reviewed by a person.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ApplicationVulnerability scanning of AI components · Adversarial testing before deployment · Short-lived, scoped credentials · Live behaviour monitoring · AI incident response plan · Segmentation of agent components · Encryption of stored data
Infrastructure / targetKnown flaws patched · Intrusion and endpoint detection · Inventory of exposed services
Similar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- Issue identified and remediated before any PyPI release.
- The latest PyPI package, autogenstudio 0.4.2.2, does not contain the AutoJack weaknesses.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
No exploitation in the wild is reported.
LR-2026-0589 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON