Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

Manifold Security found a confused-deputy bug in Microsoft's official Azure DevOps MCP server. A hidden HTML comment in a pull request description can hijack the AI agent of whoever reviews it.

The attack works because PR descriptions accept Markdown, which allows HTML comments. A reviewer scrolling the description sees nothing. The REST API returns the comment verbatim. When the agent reads the PR, it gets the hidden instructions too.

This splits what the human sees from what the model receives. The attacker never talks to the agent. They plant text in content they know it will read.

Microsoft already shipped a defense for this. They use spotlighting, wrapping untrusted content in delimiters so the model can tell data from instructions. They added it in PR #1062 for wiki pages and build logs.

The tool that returns pull requests never calls that helper. It hands back descriptions raw. That is the gap.

Manifold's proof of concept runs like this: a contributor opens a normal-looking PR with a hidden comment carrying the payload. When the reviewer asks their agent to review it, the hidden text rewrites the agent's goal. The agent carries the reviewer's credentials, so it can reach projects the attacker cannot.

In the demo, the agent triggers a pipeline in a different project, reads a confidential wiki page, and posts that page back as a comment where the attacker can read it. Every call was one the agent was allowed to make. The problem was the sequence and intent, driven by text the human never saw.

It worked with both Copilot CLI and Claude Code. The chain needs write access to a project, a reviewer with higher privileges, and an agent cleared to run tools without asking. The demo used auto-approve with no per-tool prompts.

Simon Willison calls this pattern the lethal trifecta: an agent with access to private data, exposure to untrusted content, and a way to send data out. Any agent with all three can be turned by one piece of text. Most useful agents have all three.

Microsoft thanked Manifold for the disclosure and called it "a known class of AI risk." They did not say whether they will fix the code or assign a CVE. As of July 21, the current source still lacks the guardrail on the PR tool.

The defenses are familiar. Give agents least-privilege tokens scoped to the project under review. Load only the MCP domains the task needs. Keep pipeline runs and wiki reads out of code-review tool sets that have no use for them.

To check whether this already happened, look in agent tool traces for cross-project pipeline runs or wiki reads during reviews. Scan open PR descriptions for hidden HTML comments. A human reviewer who cannot see the payload is not a control.

The guardrail only works where someone remembers to add it. The defense is only as strong as its least-covered path, and a missing wrapper on one function is close to invisible from outside. On a growing tool surface, gaps like this open faster than anyone audits them.