{"id":14485,"date":"2026-07-22T10:03:45","date_gmt":"2026-07-22T10:03:45","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/07\/22\/azure-devops-mcp-flaw-lets-hidden-pr-comments-hijack-ai-agents-and-steal-data\/"},"modified":"2026-07-22T10:03:45","modified_gmt":"2026-07-22T10:03:45","slug":"azure-devops-mcp-flaw-lets-hidden-pr-comments-hijack-ai-agents-and-steal-data","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/07\/22\/azure-devops-mcp-flaw-lets-hidden-pr-comments-hijack-ai-agents-and-steal-data\/","title":{"rendered":"Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data"},"content":{"rendered":"

Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A newly disclosed flaw in Microsoft\u2019s official Azure DevOps MCP server shows how an invisible comment in a pull request can silently hijack a developer\u2019s AI coding assistant and turn it into a data-exfiltration tool.<\/p>\n

Security researchers at Manifold Security found that the bug lets an attacker with access to just one project steer a victim\u2019s agent into stealing data from projects the attacker could never reach directly.<\/p>\n

Microsoft\u2019s Azure DevOps MCP server<\/a> exposes pull requests, pipelines, wikis, and work items as tools an AI agent can call on a user\u2019s behalf. Since Azure DevOps PR descriptions support Markdown, an attacker can embed instructions inside an HTML comment that renders as nothing in the web UI but is still returned verbatim by the API.<\/p>\n

When a victim asks their agent to review that PR, the agent ingests the hidden text and follows it as if it were a legitimate command, a classic case of indirect prompt injection.<\/p>\n

\n
\"Hidden
Hidden text instructions (Source: Manifold Security)<\/figcaption><\/figure>\n<\/div>\n

In the researchers\u2019 proof of concept, the injected comment instructed the victim\u2019s agent to approve the PR, trigger a pipeline in a completely different \u201cPayments\u201d project, read a confidential wiki page there, and post its contents back as a PR comment the attacker could see, all while telling the agent not to mention any of it to the human reviewer. Because the agent operates with the victim\u2019s own credentials, it could reach data the attacker had no direct access to.<\/p>\n

Azure DevOps MCP Vulnerability<\/strong><\/h2>\n

This is a \u201cconfused deputy\u201d problem: a privileged actor (the agent) is tricked into misusing its own authority on someone else\u2019s behalf. The escalation works precisely because reviewers, often more senior than whoever opened the PR, typically have broader project access than contributors, so the attacker effectively borrows that authority through text the reviewer never even sees.<\/p>\n

\"\"
Content Exfiltration (Source: Manifold Security)<\/figcaption><\/figure>\n

Microsoft had already anticipated this class of risk. The server uses a defense called \u201cspotlighting,\u201d which wraps untrusted external content in delimiters so the model can distinguish data from instructions.<\/p>\n

That fix, introduced in PR #1062<\/a>, was applied to the tools returning pipeline and wiki content, but not to the tool returning PR descriptions, leaving exactly the entry point attackers used.<\/p>\n

Manifold Security reported the issue<\/a> to the Microsoft Security Response Center, which acknowledged and triaged it; as of publication, no CVE has been assigned, and no fix has shipped.<\/p>\n

Researchers tie this incident to Simon Willison\u2019s \u201clethal trifecta\u201d framework<\/a> for agentic risk: access to private data, exposure to untrusted content, and a channel to send data out. Any AI agent combining all three, exactly what the Azure DevOps MCP server does, can be turned against its owner by a single piece of poisoned text.<\/p>\n

Takeaway for Defenders<\/strong><\/h2>\n

Security teams reviewing MCP-connected agents should consider the following steps:<\/p>\n