A flaw in Microsoft’s Azure DevOps MCP server could let a hidden comment in a pull request redirect a reviewer’s AI agent into other projects and leak data, according to a technical analysis by Manifold Security published this week. The issue was still present in the source reviewed on July 21, and no CVE had been assigned publicly.
KEY FACTS
- Trigger An HTML comment in an Azure DevOps pull request can remain invisible in the web interface.
- Impact An AI agent can treat the hidden text as instructions and act with the reviewer’s permissions.
- Exposure The affected tool returns pull request descriptions without the same guardrail used on other outputs.
- Proof The researchers said they reproduced the chain with Copilot CLI and Claude Code.
Azure DevOps pull request descriptions support Markdown and HTML comments, which do not display in the normal interface. The server passes that text to the agent, creating a gap between what a reviewer sees and what the model receives.
Manifold said the tool path for pull requests does not use the same spotlighting wrapper that Microsoft applied to wiki pages and build logs in a prior code change. That omission leaves raw description text exposed to prompt injection, the report said.
In the proof of concept, a hidden comment prompted an agent to trigger a pipeline in another project, read a private wiki page and post the contents back to the pull request. The researchers said the attack depended on the reviewer’s access being broader than the attacker’s and on the agent being allowed to run tools without per-action prompts.
Microsoft said it thanked the researchers for coordinated disclosure and described the issue as a known class of AI risk. The company said customers should limit project access and review proposed changes before asking an AI tool to act on them.
WHY IT MATTERS
The case shows how an AI agent can be steered by text that a human reviewer cannot see, if the tool has access to private data and a path to send information out. That makes least-privilege access, narrower tool scope and human checks on agent actions important, especially as automated review workflows expand.