Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents

A single invisible comment embedded in an Azure DevOps pull request can silently hijack a reviewer's AI coding agent, steering it into projects the attacker has no permission to access and exfiltrating source code, secrets, and work items along the way. The flaw resides in Microsoft's official Azure DevOps MCP (Model Context Protocol) server, which lets AI agents read and operate Azure DevOps resources on a user's behalf, carrying the user's own credentials across pull requests, pipelines, wikis, and work items. That trust delegation is precisely what makes the bug dangerous: content authored by another person becomes instructions the agent will execute.

The delivery mechanism exploits a split between human-visible and machine-readable content. Azure DevOps pull request descriptions accept Markdown, which supports HTML comments, and the syntax renders as nothing in the web UI, so a reviewer sees an ordinary change description. The REST API returns the comment verbatim, and the MCP server hands that raw text to the agent without any guardrail. When the reviewer asks their agent to review the PR, the hidden payload rewrites the agent's goal, and because the agent is operating under the reviewer's identity, it can trigger pipelines, read repositories, and pull secrets in projects the original attacker could never reach. Agentic runtime security firm Manifold Security detailed the confused-deputy vulnerability this week, noting that reviewers are typically more senior than pull request authors, making privilege escalation the normal case rather than an edge scenario.

What elevates this beyond a generic prompt-injection warning is that Microsoft had already shipped a partial defense. Manifold's review of the server's source found that the codebase uses spotlighting, a technique from Microsoft's own indirect prompt injection guidance that wraps untrusted content in delimiters so the model can distinguish data from instructions. The guardrail was added in PR #1062, where the wiki-page and build-log tools route their output through a shared helper called createExternalContentResponse. The tool that returns pull request data, repo_get_pull_request_by_id, never calls that helper and returns descriptions raw, exactly the surface an attacker writes to. The Hacker News confirmed the same path remains uncovered in the current source as of July 21. Manifold's proof of concept, run against a local build of v2.7.0, showed a contributor opening a normal-looking PR whose hidden comment carries the payload; once the agent begins its review, the injected instructions trigger a pipeline in a separate project and exfiltrate the results. Organizations relying on AI-assisted code review should audit their MCP server builds, patch to a fixed release when available, and treat PR descriptions from untrusted contributors as untrusted input. Security teams can also run a quick port scanner to verify that build agents and pipeline runners are not exposing additional services to the network, and a password checker to confirm that any secrets cached on review workstations meet current strength standards. For broader posture, a SSL/TLS checker can confirm that the Azure DevOps endpoints AI agents connect to are properly encrypted and certificate-validated.