Microsoft’s official Azure DevOps MCP Server has been found to contain a security flaw that could allow hidden pull request comments to manipulate artificial intelligence coding agents into accessing sensitive information beyond an attacker’s authorized permissions. The vulnerability, disclosed by offensive security company Manifold Security, affects the Microsoft server that enables AI agents to interact with Azure DevOps using a reviewer’s own permissions. These AI agents can perform tasks involving pull requests, pipelines, work items, and project documentation on behalf of users. Researchers found that a specially crafted hidden comment embedded inside a pull request description can alter the AI agent’s behavior, causing it to perform unintended actions using the reviewer’s privileges. The issue relies on the difference between what a human reviewer sees in the Azure DevOps interface and the information returned through the platform’s programming interface, allowing malicious instructions to remain invisible while still being processed by the AI model.
According to Manifold Security, Azure DevOps pull request descriptions support Markdown formatting, including HTML comments that are hidden from users viewing the pull request through the web interface. Although these comments remain invisible to reviewers, they are returned unchanged through the Azure DevOps REST API and passed directly to the AI agent without protective filtering. Researchers explained that this allows an attacker to place hidden instructions inside a pull request description without communicating directly with the AI system. When a reviewer later asks an AI coding assistant to review the pull request, the concealed instructions can change the agent’s objectives and direct it to access resources outside the attacker’s own permissions. Because the AI agent operates with the reviewer’s credentials, it can potentially access source code repositories, confidential documentation, work items, pipelines, and other resources available to the reviewer. In a proof of concept demonstration, Manifold Security showed that the manipulated AI agent triggered a pipeline in another project, accessed a confidential wiki page, and posted the retrieved information back into the compromised pull request where it became visible to the attacker.
Researchers noted that Microsoft had already implemented a mitigation technique known as spotlighting within other parts of the Azure DevOps MCP Server. This approach wraps untrusted content with delimiters so artificial intelligence models can distinguish user supplied data from operational instructions, reducing the risk of indirect prompt injection attacks. However, Manifold Security found that the function responsible for returning pull request information, identified as repo_get_pull_request_by_id, did not use the same protective wrapper. As a result, pull request descriptions were delivered directly to AI agents without additional safeguards. The researchers confirmed the same issue remained present in the publicly available source code as of July 21 and demonstrated the attack using both Microsoft Copilot CLI and Claude Code, indicating that the vulnerability affects multiple AI coding assistants rather than a single product. The researchers also observed that similar prompt injection techniques have previously been demonstrated against GitHub’s MCP Server, highlighting a broader challenge facing AI assisted software development environments where trusted agents interact with untrusted content.
Microsoft acknowledged the responsible disclosure from Manifold Security and described the issue as part of a known category of artificial intelligence security risks that continues to influence the company’s ongoing work on AI safeguards. The company stated that successful exploitation requires an attacker to have permission to submit pull requests and a reviewer to invoke an AI tool capable of acting on the embedded content. Microsoft recommended limiting project permissions, applying the principle of least privilege to AI agent access, and carefully reviewing changes before requesting AI assistance. Researchers also advised organizations to restrict AI agents to only the tools and projects required for specific tasks, avoid granting unnecessary access to pipelines or wiki content during code reviews, and monitor AI activity logs for unusual cross project actions. They further recommended scanning pull request descriptions for hidden HTML comments because the embedded payload remains invisible to human reviewers. At the time of disclosure, no software update or Common Vulnerabilities and Exposures identifier had been released, and researchers noted that the vulnerability stems from the server’s implementation rather than the communication method used by the AI agent.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
