A newly disclosed attack technique called AutoJack demonstrates that a single malicious web page can hijack an AI browsing agent built on Microsoft’s AutoGen Studio framework and execute arbitrary code on the host machine, requiring no user action beyond the agent loading the attacker-controlled page. The root cause is insufficient isolation between the agent’s browser context and privileged local services exposed through the Model Context Protocol (MCP), allowing an unprivileged web page to escalate directly to host-level code execution. This finding signals a broader class of risk: as organizations integrate AI agents with local tool access, the attack surface expands in ways that traditional endpoint and network defenses were not designed to address.