MouseJack

MouseJack All the details and steps needed to perform mousejacking with or without Autojack. Mousejacking is class vulnerabilies that was discovered in 2016 by researchers at Bastille. Mousejacking is an often over looked method of gaining a foothold in a network. All the specifics about the...

AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution

Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution. Steer the agent to load an attacker's web page, and that page's JavaScript can reach a privileged local service on the same machine and spawn a...

AutoJack: How a single page can RCE the host running your AI agent

In this article 1. Why we are looking at agent frameworks 1. What is AutoGen Studio 2. The AutoJack chain at a glance 3. Anatomy of the chain 1. Issue 1: Origin allowlist that the agent itself defeats 2. Issue 2: Auth middleware that opts MCP out 3. Issue 3: serverparamsfrom the URL is the comman...