Azure DevOps MCP Flaw Exposes AI Agents
Manifold Security disclosed on July 21 that hidden HTML comments in Azure DevOps pull-request descriptions can inject instructions into AI agents using Microsoft's MCP server. Its proof of concept used a reviewer's broader credentials to perform cross-project actions and leak data. Microsoft acknowledged and triaged the report, but no fixed release or CVE was public as of July 21.
Manifold Security disclosed on July 21, 2026, that an attacker can hide prompt-injection instructions inside an Azure DevOps pull-request description and have Microsoft's official MCP server pass them to an AI coding agent. The instructions are invisible in the normal pull-request view because they sit inside an HTML comment, but the API returns them and the agent receives them as context.
In Manifold's proof of concept, an attacker with contributor access to one project planted the hidden text. When a more privileged reviewer asked an agent to review the pull request, the agent used the reviewer's credentials to trigger a pipeline in another project, read a confidential wiki page, and post the content back where the attacker could see it. The researchers reproduced the chain with Copilot CLI and Claude Code.
A guardrail missed one input path
Microsoft's Azure DevOps MCP server already includes a defense called spotlighting for some untrusted external content. Pull request #1062 added a shared response wrapper to distinguish external data from agent instructions for tools including wiki and build-log retrieval.
Manifold found that the tool returning pull-request details did not use the same wrapper, leaving descriptions exposed to the model as raw text. The Hacker News independently reviewed the code path and reported that it remained uncovered as of July 21. Spotlighting is a guardrail rather than a complete prompt-injection defense, but inconsistent use created a concrete route around the protection Microsoft had already introduced elsewhere.
Scope and current status
The attack requires several conditions: an attacker who can write pull-request content, a victim who invokes an AI tool over that content, victim permissions that reach data the attacker cannot access, and an agent allowed to execute sensitive tools without per-action approval. Manifold tested an auto-approve posture, which removed the checkpoint that might otherwise expose an unexpected cross-project action.
Manifold says Microsoft acknowledged and triaged the report through MSRC. The Hacker News reported that Microsoft described the behavior as a known class of AI risk and advised limiting project access and reviewing proposed changes before an AI tool acts. As of July 21, the reporting identified neither a fixed release nor an assigned CVE, and it found no evidence of exploitation outside the researchers' testing.
Teams using MCP-connected coding agents should treat repository text as untrusted input, apply the same content-handling controls across every read tool, keep agent credentials least-privileged, and require approval for cross-project reads, pipeline execution, or outbound posting. Logs should make the full tool-call sequence reviewable, because each individual call in this chain was authorized even though the combined intent was malicious.
Key Points
- 1Hidden HTML comments in Azure DevOps pull-request descriptions can reach AI agents through the official MCP server even though reviewers do not see the text in the web interface.
- 2Manifold Security's proof of concept used a reviewer's broader credentials to execute cross-project actions and exfiltrate wiki content; the chain required attacker write access, victim invocation, broader victim permissions, and permissive tool approval.
- 3Microsoft acknowledged and triaged the report, but the retrieved reporting identified no fixed release, CVE, or exploitation beyond researcher testing as of July 21.
Scoring Rationale
The disclosure demonstrates a concrete indirect prompt-injection path in Microsoft's official Azure DevOps MCP server, with cross-project effects under a victim's credentials. Exploitation requires multiple prerequisites, and the retrieved evidence does not show in-the-wild abuse, a CVE, or a public fixed release, keeping the score below critical.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
