Azure DevOps MCP Flaw Exposes AI Agents
Manifold Security disclosed on July 21 that hidden HTML comments in Azure DevOps pull-request descriptions can inject instructions into AI agents using Microsoft's MCP server. Its proof of concept used a reviewer's broader credentials to perform cross-project actions and leak data. Microsoft acknowledged and triaged the report; a July 27 check found the public repository's pull-request path still returned the description without the spotlighting wrapper.
Manifold Security disclosed on July 21 that an attacker can hide prompt-injection instructions inside an Azure DevOps pull-request description and have Microsoft's official MCP server pass them to an AI coding agent. The instructions sit inside an HTML comment, so they are invisible in the normal pull-request view even though the API returns them to the agent.
In Manifold's proof of concept, an attacker with contributor access to one project planted hidden text. When a more privileged reviewer asked an agent to review the pull request, the agent used the reviewer's credentials to trigger a pipeline in another project, read a confidential wiki page and post the content back where the attacker could see it. The researchers reproduced the chain with Copilot CLI and Claude Code.
One response path missed a guardrail
Microsoft's Azure DevOps MCP server includes a defense called spotlighting for some untrusted external content. Pull request #1062, merged in March, added a shared response wrapper around wiki pages and build logs so models can distinguish external data from instructions.
Manifold found that the pull-request retrieval path did not use the same wrapper. A fresh July 27 review of the repository's public main branch found that the repo_pull_request action still returned the pull-request object as raw JSON rather than through createExternalContentResponse. The latest tagged release remained version 2.8.0, published June 24.
Spotlighting is a guardrail, not a complete prompt-injection defense. The defect is the inconsistent treatment of attacker-writable data across tools that can be composed into a privileged workflow.
Scope and disclosure status
The demonstrated chain requires several conditions: an attacker who can write pull-request content, a victim who asks an agent to process it, victim credentials that reach data the attacker cannot access, and an agent permitted to execute sensitive tools without per-action approval. Manifold tested an auto-approve posture, removing a checkpoint that might otherwise expose the unexpected cross-project calls.
Manifold says Microsoft acknowledged and triaged the report through MSRC. The Hacker News reported that Microsoft described the behavior as a known class of AI risk and advised limiting project access and reviewing proposed changes before an AI tool acts. Its July 22 report identified no fixed release, assigned CVE or exploitation outside the researchers' testing. LDS's repository check confirmed that no newer tagged release was public on July 27; it does not establish the status of nonpublic Microsoft remediation.
What teams should do
Repository text should be treated as untrusted input even when it appears in an authenticated development system. Teams should apply consistent content handling across every read tool, scope agent credentials to the project under review, and require approval for cross-project reads, pipeline execution and outbound posting.
Logs should also preserve the full tool-call sequence. Every individual action in Manifold's demonstration was authorized under the reviewer's credentials; the malicious behavior emerged from the sequence and intent.
Key Points
- 1Hidden HTML comments in Azure DevOps pull-request descriptions can reach AI agents through the official MCP server even though reviewers do not see the text in the web interface.
- 2Manifold Security's proof of concept used a reviewer's broader credentials to execute cross-project actions and exfiltrate wiki content; the chain required attacker write access, victim invocation, broader victim permissions, and permissive tool approval.
- 3Microsoft acknowledged and triaged the report, while a July 27 check found the public main-branch pull-request response still lacked the spotlighting wrapper.
Scoring Rationale
The disclosure demonstrates a concrete indirect prompt-injection path in Microsoft's official Azure DevOps MCP server, with cross-project effects under a victim's credentials. Exploitation requires multiple prerequisites, and the retrieved evidence does not show in-the-wild abuse or a public fixed release, keeping the score below critical.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
