A critical vulnerability has been discovered in Microsoft's Azure DevOps MCP server, where a flaw allows invisible comments in pull request descriptions to manipulate AI code review agents. This issue arises because Microsoft's tool for processing pull request descriptions does not implement prompt-injection guardrails, leaving AI agents exposed to hidden instructions embedded in HTML comments. When a reviewer uses an AI agent to evaluate a pull request, the agent, carrying the reviewer's permissions, can be misdirected to access unauthorized projects and data, including source code and sensitive information.
This flaw, identified by Manifold Security, exploits a split between the visible content reviewers see and the hidden instructions that AI models receive. The vulnerability allows attackers to leverage the reviewer's credentials and access, bypassing restrictions that would usually limit their reach. Despite Microsoft's prior defenses against such prompt-injection techniques, a specific function within the server's codebase failed to apply these safeguards, leaving it vulnerable.
The attack requires specific conditions: an attacker must have write access to the project, and a reviewer with higher access privileges must use an AI tool to review the pull request. Manifold's proof of concept demonstrated the attack by triggering cross-project actions and exfiltrating data unseen by human reviewers. Microsoft has acknowledged the issue as a known AI risk but has not yet released a fix or assigned a CVE to the vulnerability.
While the flaw primarily affects local server implementations, the hosted remote MCP server may also be vulnerable. Organizations using Azure DevOps are advised to restrict project access, ensure AI tools have limited privileges, and carefully review changes before deploying AI agents. Although existing defenses like 'spotlighting' can mitigate such risks, they are only effective when consistently applied, underscoring the importance of thorough security audits.