Plaintext with Rich
Cybersecurity is an everyone problem. So why does it always sound like it’s only for IT people?
Each week, Rich takes one topic, from phishing to ransomware to how your phone actually tracks you, and explains it in plain language in under ten minutes or less. No buzzwords. No condescension. Just the stuff you need to know to stay safer online, explained like you’re a smart person who never had anyone break it down properly. Because you are!
Plaintext with Rich
AutoJack Attack: How Malicious Pages Hijack AI Browsing Agents
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
You told your AI assistant to book a flight and compare hotels. You come back, and it did all of that. It also ran commands on your machine that you never approved. What just happened?
This episode unpacks AutoJack, a demonstrated attack pattern where malicious web pages hijack AI browsing agents through prompt injection. We cover how untrusted web content can steer autonomous agents into unsafe actions, the critical risk of localhost access in agent frameworks like AutoGen, and the chain from reading a bad page to remote code execution on your host machine. You'll learn why giving an agent a browser is fundamentally different from giving it information access, and how ambient authority plus autonomous actions creates a blast radius most teams haven't planned for.
This is for security teams adopting AI agents, engineering leads building agentic tools, and anyone who needs to understand the new attack surface before deploying browsing automation at work.
One Topic, Ten minutes, No panic.
Is there a topic/term you want me to discuss next? Text me!!
YouTube more your speed? → https://links.sith2.com/YouTube
Apple Podcasts your usual stop? → https://links.sith2.com/Apple
Neither of those? Spotify’s over here → https://links.sith2.com/Spotify
Prefer reading quietly at your own pace? → https://links.sith2.com/Blog
Join us in The Cyber Sanctuary (no robes required) → https://links.sith2.com/Discord
Follow the human behind the microphone → https://links.sith2.com/linkedin
Need another way to reach me? That’s here → https://linktr.ee/rich.greene
When Helpful Agents Go Rogue
SPEAKER_00You ask your new AI assistant to book a flight, compare three hotels, and start your expense report while you're in a meeting. And you come back half an hour later and it did all of it. Perfectly. That's why we love agents, right? What you don't see though is the other thing that it did. It followed a hidden instruction on a web page, reached out to a service on your own computer, and ran a command that nobody asked for, or at least that you didn't ask for, somebody asked for it. Welcome to Plain Text with Rich.
Auto Jack Explained In Plain Terms
SPEAKER_00Today we're talking about Auto Jack and why handing an AI agent a web browser opens a brand new kind of door. We're going to go over two quick definitions really fast. An AI browsing agent is software that reads web pages, makes decisions based on what it sees, and takes actions for you. Not just here's a summary, but actual clicking, typing, submitting, and downloading. Auto Jack is the name for an attack researchers demonstrated where a single booby-trapped web page can steer one of these agents into doing something dangerous, right? All the way up to even running code on the computer that it's sitting on. And here's the reassuring part. Before we get to the scary version of this, Auto Jack was found by Microsoft's own researchers in a test version of one of their tools and fixed before it ever reached the public. Nobody got hit, at least that I'm aware of. This is a more of a fire drill, right? Not a fire, but the drill is worth your 10 minutes because the shape of this risk is not going away. As always, if you want the ground version of AI really risk at work, head back to episode 16. Today is going to be that next layer up. This isn't about a chatbot leaking something you typed. This is about an agent getting tricked through a web page on a machine that can actually do stuff and things. What I want you to do, right? Or I should say, right, the shift here, and this is the shift for the whole
Prompt Injection And Hidden Instructions
SPEAKER_00episode, right? When you give an agent a browser, you're not just giving it, you know, eyes, you're also giving it hands. A regular chatbot reads and answers. A browsing agent goes and does, right? It clicks, it submits forms, it downloads files, and it can reach the little helper programs running on your own computer. So it's say, picture it this way: a normal chatbot is like asking a librarian for directions, right? A browsing agent is like handing your librarian your keys and your air and list and saying, hey, go take care of this while I'm out. Most days that's wonderful. It saves you an afternoon. But on a bad day, a stranger tapes a fake note to one of the doors, right? Official instructions, do this. And the librarian trying to be helpful follows it. That fake note has a name, and it's prompt injection. In plain text, prompt injection is when a web page hides instructions inside it. And the AI reads those instructions and treats them like orders from you. You said, summarize this page. The page said quietly, also go do this other thing. And the agent can't always tell the difference between your request and the page's request.
The Local Helper Door Problem
SPEAKER_00Now, prompt injection is only how the attacker gets the agent pointed at the trap. It's the lore, right? The actual damage came from something more old-fashioned, broken locks on the inside. A lot of software runs little helper services right on your own machine, just for you, not meant for the outside world. In this case, one of those helpers would take a command and run it. And it wasn't bothering to check who was asking, right? It assumed that anything coming from the same computer, well, it had to be friendly. So the chain would look like this: the agent reads the poison page, the page tells the agent's browser to go knock on that local helper's door. The helper opens up, no questions asked, and runs whatever it's handed. Read the page, follow the hidden order, knock on the unlocked door, code runs, no password broken, no genius required, just a series of doors that should have been locked and were not. Here's I think the detail that I love. When researchers prove one of these works, they don't steal anything. They make the target computer pop open the calculator app, right? It sounds like a joke, but it's really not. The calculator is the flag on that mountain. If a stranger's web page can make your machine open the calculator, it can make your machine open, well, anything else. Same door, different thing, walking through it. So why does
Why The Pattern Will Spread
SPEAKER_00this matter if it was caught and fixed? Well, because the specific tool is not the point, I would say it's the pattern, right? Untrusted stuff from the internet, plus an agent that can take real actions, plus the ability to reach into your own machine, right? Anytime those three things sit together without strong walls between them, you kind of got the same risk. And right now we are bolting agents onto everything. And boy, do I mean everything. So what do you do, right?
Five Practical Guardrails For Agents
SPEAKER_00Without panicking and without waiting for the whole industry to figure it out, as always, I got five moves for you. I got five. Move number one, put the agent in a sealed room, run it in an isolated space, right? So if it does something dumb, it can't reach the rest of your computer. Uh think of it like a play pen if you if you've had children or you had grow up with siblings. It can make a mess inside, but the mess stays inside. And sometimes the kids throw things out of it. Uh, move number two, uh cut it off from the private services on your machine. That local helper door we talked about, an agent out browsing the wild internet has no business knocking on it. Block that by default and only open it for a specific written-down reason. Uh move number three, make it ask permission for anything that matters, downloading a file, running a command, changing a password, touching an admin tool, right? The agent can reason all at once, but a human says yes before the big stuff happens. Move number four, keep it on a short leash. Give it a small list of sites it's allowed to visit, and only the permissions it actually needs to do the job, not the run of the house. Boy, again, SEC 301 students have probably heard me mention privilege or principal least privilege more times than they'd ever like to remember. We should do the same things here. Move number five, keep those receipts, right? You want a clear record of which instruction came from you, which came from a web page, and what the agent actually did. When something goes sideways, that record is the difference between knowing what happened and guessing. And one more, quietly, I say quietly
Two Must-Do Steps For Small Teams
SPEAKER_00important, right? Stay on the finished released versions of these tools and skip the half-baked test builds unless you really know what you're doing. This whole thing lived in an unfinished version. The stable one was fine. And hey, I know it. We don't have large teams, right? And if that's you, a team of one, maybe two, right? Do these two things instead. Put the agent in a sealed room and make it ask a human before anything of high impact, right? Those two alone knock the risk way down while you build the rest, okay?
Recap And Listener Questions
SPEAKER_00When we recap this for us, auto jack put a name on a risk that's about to be everywhere, right? A single web page can whisper to your AI, AI agent and steer it, and that's never good. And if that agent can reach into your machine, the whisper can end in code running that you never approved or intended to happen. The answer here is to not swear off AI or agents. They're too useful. And this is where things are headed. The answer is walls, permissions, short leashes, and receipts, right? You can move forward, just don't move blindly, right? So send me your agent setup questions. Your weirdest browser automation story, the one guardrail that saved you from a bad deploy, email, DMs, uh, comments, whatever channel you like, please. Every message gets read and every message gets answered. Bonus points if you send me the strangest hidden instruction you've ever found buried in a web page's source. Hey, if you're enjoying this, go hit subscribe or follow or whatever the button says on your listening apparatus. It's the best way to make sure that the next episode finds you when it releases. And hey, if this helps, if you enjoyed this, pass it to someone else who you think could benefit from a listen. This has been Plain Text with Rich. One topic, 10 minutes, no panic.