Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data

A newly disclosed flaw in Microsoft’s official Azure DevOps MCP server shows how an invisible comment in a pull request can silently hijack a developer’s AI coding assistant and turn it into a data-exfiltration tool.

Security researchers at Manifold Security found that the bug lets an attacker with access to just one project steer a victim’s agent into stealing data from projects the attacker could never reach directly.

Microsoft’s Azure DevOps MCP server exposes pull requests, pipelines, wikis, and work items as tools an AI agent can call on a user’s behalf. Since Azure DevOps PR descriptions support Markdown, an attacker can embed instructions inside an HTML comment that renders as nothing in the web UI but is still returned verbatim by the API.

When a victim asks their agent to review that PR, the agent ingests the hidden text and follows it as if it were a legitimate command, a classic case of indirect prompt injection.

In the researchers’ proof of concept, the injected comment instructed the victim’s agent to approve the PR, trigger a pipeline in a completely different “Payments” project, read a confidential wiki page there, and post its contents back as a PR comment the attacker could see, all while telling the agent not to mention any of it to the human reviewer. Because the agent operates with the victim’s own credentials, it could reach data the attacker had no direct access to.

Azure DevOps MCP Vulnerability

This is a “confused deputy” problem: a privileged actor (the agent) is tricked into misusing its own authority on someone else’s behalf. The escalation works precisely because reviewers, often more senior than whoever opened the PR, typically have broader project access than contributors, so the attacker effectively borrows that authority through text the reviewer never even sees.

Microsoft had already anticipated this class of risk. The server uses a defense called “spotlighting,” which wraps untrusted external content in delimiters so the model can distinguish data from instructions.

That fix, introduced in PR #1062, was applied to the tools returning pipeline and wiki content, but not to the tool returning PR descriptions, leaving exactly the entry point attackers used.

Manifold Security reported the issue to the Microsoft Security Response Center, which acknowledged and triaged it; as of publication, no CVE has been assigned, and no fix has shipped.

Researchers tie this incident to Simon Willison’s “lethal trifecta” framework for agentic risk: access to private data, exposure to untrusted content, and a channel to send data out. Any AI agent combining all three, exactly what the Azure DevOps MCP server does, can be turned against its owner by a single piece of poisoned text.

Takeaway for Defenders

Security teams reviewing MCP-connected agents should consider the following steps:

• Scope agent tokens to least privilege, limited to the project under review.
• Load only the MCP tool domains a task actually needs, using scoping flags where available.
• Exclude pipeline execution, wiki reads, and comment-posting from code-review-only tool sets.
• Audit PR descriptions for hidden HTML comments and review agent tool-call traces for unexpected cross-project activity.

The core takeaway, researchers note, is that every individual action the agent took was technically authorized; the danger came from the sequence and hidden intent, which is why agent-driven automation demands continuous visibility rather than one-time code audits.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment

The post Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data appeared first on Cyber Security News.