/00 — boot sequence

Hello.

aiyu
← Back to Blogs

Article

Azure DevOps MCP Flaw: Hidden PR Comments Hijack AI Review Agents

August 1, 2026•7 min read
security azure-devops mcp prompt-injection ai-agent spotlighting

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds.

The flaw lies in Microsoft's official Azure DevOps MCP server — the component that lets AI agents read and operate Azure DevOps on a user's behalf across pull requests, pipelines, wikis, and work items, all with the user's own permissions.

Agentic runtime security firm Manifold Security detailed the confused-deputy bug this week. The attack works because one of the server's tools returns pull request descriptions without a prompt-injection guardrail that Microsoft had already applied to other tools.

Vulnerability Details

The Delivery Mechanism: Invisible HTML Comments

Azure DevOps PR descriptions accept Markdown, which allows HTML comments (<!-- ... -->). In the web UI, an HTML comment renders as nothing — a reviewer scrolling the description sees an ordinary change. But the REST API returns it verbatim, and the MCP server hands that text straight to the AI agent.

That split between what the human sees and what the model receives is the delivery mechanism: the attacker never talks to the agent directly but plants instructions in content they know it will later read.

When the reviewer asks their agent to review the PR, the hidden text can rewrite the agent's goal. The agent carries the reviewer's credentials, so it can act across projects the attacker has no rights to reach.

The Guardrail Gap: Spotlighting Missed One Path

What lifts this above a generic prompt-injection warning is that Microsoft already shipped a defense for it. Reading the server's source, Manifold found it uses spotlighting — a technique from Microsoft's own guidance on indirect prompt injection: wrapping untrusted content in delimiters so the model can tell data apart from instructions.

The company added spotlighting in PR #1062, where the wiki-page and build-log tools pass their output through a shared helper, createExternalContentResponse.

The tool that returns a pull request, repo_get_pull_request_by_id, never calls it — so it hands back the description raw, which is exactly the surface an attacker writes to.

The Hacker News confirmed the same path is still uncovered in the current source as of July 21, 2026.

Proof of Concept

In Manifold's PoC, run on a local build of v2.7.0:

  1. A contributor to one project opens a normal-looking PR whose hidden comment carries the payload
  2. Once the agent starts its review, the tool trace runs a chain:
    • Triggers a pipeline in a different project
    • Reads a confidential wiki page the attacker cannot open
    • Posts that page back as a comment on the PR, where the attacker reads it

A single hidden comment drove the whole sequence, and every call was one the agent was allowed to make. The problem was "the sequence and intent, driven by text that a human never saw."

The team reproduced it with both Copilot CLI and Claude Code, so it is not tied to one agent.

Prerequisites for Exploitation

The chain requires:

  • Attacker-written PR text (write access to a project)
  • A workflow that feeds PR content to an AI agent
  • A reviewer whose access exceeds the attacker's (normal case — reviewers are often more senior)
  • An agent cleared to run tools without asking (auto-approve posture)

Manifold tested the auto-approve posture with no per-tool prompts — the checkpoint that would otherwise let a reviewer catch an odd cross-project pipeline run before it fires. A broad token plus that posture is where the risk concentrates.

Automated Review Escalation

The demo assumes a person kicks off the review, but Manifold notes where teams are heading: automated review, triage, and summaries fired by triggers, with no human prompting each run or reading each result. In that setup, the planted description fires on its own, and the leak runs longer before anyone notices.

Impact Assessment

This is a confused-deputy attack with a novel delivery vector. The attacker gains nothing directly; they borrow the reviewer's access through text the reviewer never sees.

Access reaches:

  • Source code across projects
  • Secrets and credentials
  • Work items and confidential wiki pages
  • Pipeline execution in projects the attacker cannot access

The pattern is not new. In May 2025, Invariant Labs showed the same class of attack against GitHub's MCP server, using a public issue to push an agent into reading a private repo and leaking it through a PR. The same technique has since reached automated GitHub agent workflows.

Simon Willison named this the lethal trifecta: an agent with access to private data, exposure to untrusted content, and a way to send data out. Any agent with all three can be turned on its owner by one piece of text — and most useful ones have all three.

Vendor Response

A Microsoft spokesperson thanked Manifold for reporting under coordinated disclosure and called it "a known class of AI risk" that informs ongoing work on safeguards. Microsoft did not say whether it would change the code or assign a CVE.

As of July 21, 2026:

  • No fixed release — latest release v2.8.0 shipped June 24
  • No CVE assigned in public databases
  • Microsoft noted the attack requires an attacker to already have write access and a second user to invoke an AI tool
  • Recommended: limit project access and "review proposed changes before asking an AI tool to act on them" — but the payload is invisible in the interface a human reviews

Manifold confirmed the root cause is "in the server's code, not the transport," meaning the hosted remote MCP server (public preview) would likely be exposed too, though untested.

Mitigation & Detection

Immediate Defenses

  1. Give the agent least-privilege tokens scoped to the project under review
  2. Load only the MCP domains the task needs — the local server narrows them with a -d flag
  3. Keep pipeline runs, wiki reads, and comment posting out of a code-review tool set that has no use for them
  4. Require per-tool approval — auto-approve posture is where risk concentrates

Detection

To check whether the chain has already run:

  • Look in the agent's tool traces for cross-project pipeline runs, wiki reads, or comments it posted during a review
  • Scan open PR descriptions for hidden HTML comments — a human reviewer who cannot see the payload is not a control

The Structural Problem

Spotlighting raises the bar but does not close prompt injection by itself. The defense is only as strong as its least-covered path, and a missing wrapper on a single function is close to invisible from outside. On a tool surface that keeps growing, gaps like this open faster than anyone thinks to audit them.

Key Takeaways

  1. Invisible content in PR descriptions is a novel prompt-injection vector — HTML comments render as nothing to humans but are read verbatim by agents
  2. Microsoft already had the fix (spotlighting) but missed one code path — the repo_get_pull_request_by_id tool
  3. Auto-approve agent posture + broad tokens = maximum risk — the checkpoint that would catch cross-project actions is disabled
  4. Automated review workflows amplify the danger — no human in the loop to notice odd behavior
  5. No CVE, no patch yet — defenders must implement compensating controls today

Frequently Asked Questions

Is this a vulnerability in the AI model?

No. This is a vulnerability in the MCP server integration — specifically, a missing input sanitization wrapper on one tool. The model behaves correctly given the input it receives.

Does this affect GitHub Copilot / GitHub MCP?

The same class of attack was demonstrated against GitHub's MCP server in May 2025 (Invariant Labs). The pattern is platform-agnostic: any MCP server that returns untrusted content without spotlighting is vulnerable.

What is "spotlighting"?

A prompt-injection defense from Microsoft where untrusted content is wrapped in explicit delimiters (e.g., <<BEGIN_EXTERNAL_CONTENT>> ... <<END_EXTERNAL_CONTENT>>) so the model can distinguish data from instructions.

Can I detect if I've been attacked?

Check agent tool traces for: cross-project pipeline triggers, wiki reads from unrelated projects, comments posted during reviews, and scan PR descriptions for <!-- ... --> HTML comments.

Should I disable my Azure DevOps MCP server?

If you use AI agents for code review, implement the mitigations above immediately. Least-privilege tokens, scoped MCP domains, and per-tool approval are effective compensating controls.

Will Microsoft assign a CVE?

As of July 21, no CVE has been assigned. Microsoft characterized it as "a known class of AI risk" rather than a traditional vulnerability.

Sources:

Automated Transmission

This entry was synthesized and populated dynamically using native API integrations.

Resources & Links