Executive Summary
Microsoft researchers detailed AutoJack, an exploit chain in which a web page loaded by an AI browsing agent reaches a privileged local service and starts a process on the host, without credentials or further interaction.
What Happened
Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same machine and spawn a process on the host. No credentials, no sign-in screen, and no further user interaction once
Vulnerability / Attack Technique
Web page reaching privileged local services through a browsing agent
Technical Mechanism
As reported, page script could reach a privileged service running on the same machine as the agent.
AI Security Category
LLM06:2025 Excessive Agency
Part of the AI Agent Excessive Agency topic.
Relevant Frameworks
RealGround Analysis
Local services assumed safe become reachable once an agent browses for you. RealGround analysis: run browsing agents isolated from privileged local services.
Recommended Controls
- Run browsing agents in isolated environments
- Require authentication on local services
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/autojack-attack-lets-one-web-page.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.