Azure DevOps MCP Flaw Allows Hidden Comments to Hijack AI Review Agents
A vulnerability in Microsoft Azure DevOps MCP enables attackers to inject hidden, malicious comments into pull requests, potentially compromising AI review agents and leading to unauthorized data exfiltration.
A critical vulnerability has been discovered in Microsoft's Azure DevOps MCP (Microsoft Collaborative Platform) server, allowing attackers to manipulate AI review agents through hidden comments within pull requests. This flaw, dubbed a "confused deputy" bug by security firm Manifold Security, enables malicious actors to redirect AI agents to access unauthorized projects and exfiltrate sensitive data.
The vulnerability arises from how the Azure DevOps MCP server processes pull request descriptions. While the web UI renders HTML comments (<!-- ... -->) as invisible, the underlying REST API returns them verbatim. This text is then fed directly to AI agents tasked with reviewing code changes. Attackers can exploit this by embedding malicious instructions within these hidden comments, which the AI agent will process as legitimate commands.
When a reviewer initiates an AI-assisted code review, the agent, operating under the reviewer's credentials, can be tricked into performing actions beyond its intended scope. This allows the attacker to leverage the reviewer's elevated permissions to access resources and data in projects the attacker would otherwise have no access to, including source code, secrets, and work items.
Manifold Security highlighted that Microsoft had previously implemented defenses against similar indirect prompt injection attacks in other tools within the MCP server, such as the wiki-page and build-log processors. These tools utilize a technique called "spotlighting," which wraps untrusted content in delimiters to help AI models distinguish between data and instructions. However, the specific tool responsible for retrieving pull request data, repo_get_pull_request_by_id, does not employ this safeguard, leaving it vulnerable.
In a proof-of-concept demonstration, Manifold Security showed how a hidden comment in a pull request could trigger a pipeline in a different project, access a confidential wiki page, and then exfiltrate that page's content back as a comment on the original pull request, where the attacker could retrieve it. This exploit was reproducible with both Copilot CLI and Claude Code, indicating it is not specific to a single AI agent.
The attack chain requires several prerequisites: an attacker must have write access to a project, a reviewer must invoke an AI tool on the content, the reviewer's access privileges must exceed the attacker's, and the AI agent must be configured to run tools without requiring explicit per-tool prompts. The researchers noted that the risk is amplified in environments with broad access tokens and automated review workflows, where human oversight is minimal.
Microsoft acknowledged the report, characterizing it as a "known class of AI risk" and stated it informs their ongoing security work. While no CVE has been assigned and no patch has been released as of July 21, Microsoft recommended limiting project access and carefully reviewing proposed changes before AI tools act upon them. The company also pointed out that the attack requires existing write access and user interaction with an AI tool, though the malicious payload remains invisible to human reviewers.