Microsoft Azure Dev Ops MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

Summary: Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull request descriptions without the spotlighting guardrail Microsoft applied to its wiki-page and build-log tools, so an HTML comment invisible in the web UI reaches the AI agent verbatim. In a proof of concept on a local build of v2.7.0, a hidden comment drove a reviewer's agent to trigger a pipeline in another project, read a confidential wiki page, and post it back as a PR comment, reproduced with both Copilot CLI and Claude Code; the path was still uncovered as of July 21, with no fixed release and no CVE.
Bottom line: The agent carries the reviewer's credentials, and reviewers are often more senior than the contributor who opened the pull request, so the borrowed access reaches source code, secrets, and work items the attacker could never open directly. Microsoft's own recommended control - a human reviewing proposed changes before the AI acts - fails here because the payload renders as nothing in the interface that human reads.

Read the original at The Hacker News ↗