Azure DevOps – Hidden PR Hijack AI Agents and Steal Data

Overview

Security researchers at Manifold Security have disclosed a critical flaw in Microsoft’s Azure DevOps MCP server that demonstrates how hidden pull request (PR) comments can hijack AI coding assistants. The vulnerability allows attackers to embed malicious instructions inside invisible HTML comments, tricking AI agents into exfiltrating sensitive data across projects.

How the Exploit Works

• Hidden HTML comments are injected into PR descriptions.
• These comments are invisible in the web UI but returned verbatim by the API.
• When a developer’s AI agent reviews the PR, it ingests the hidden text and executes it as legitimate instructions — a classic indirect prompt injection.
• In proof‑of‑concept tests, the injected comment instructed the agent to:
  • Approve the PR.
  • Trigger a pipeline in a different project.
  • Read a confidential wiki page.
  • Post its contents back as a PR comment visible to the attacker.

Because the agent operates with the victim’s credentials, it can access data the attacker would never reach directly.

The “Confused Deputy” Problem

This flaw represents a confused deputy attack:

• The AI agent (a privileged actor) is tricked into misusing its authority.
• Reviewers often have broader access than contributors, so attackers effectively borrow reviewer authority through poisoned text.
• Every action taken by the agent was technically authorized — the danger came from the sequence and hidden intent.

Microsoft’s Defense Gap

Microsoft anticipated this risk and introduced “spotlighting”, a defense that wraps untrusted content in delimiters to distinguish data from instructions.

• Spotlighting was applied to tools returning pipeline and wiki content.
• However, it was not applied to PR descriptions, leaving the entry point attackers exploited.
• As of publication, no CVE has been assigned and no fix has shipped.

Takeaways for Defenders

Security teams should:

• Scope agent tokens to limit access to only the project under review.
• Restrict MCP tool domains to only those needed for the task.
• Exclude risky actions like pipeline execution, wiki reads, and comment posting from code‑review tool sets.
• Audit PR descriptions for hidden instructions.
• Monitor agent tool‑call traces for unexpected cross‑project activity.

Expert in the Cloud Insight

This vulnerability highlights the unique risks of agentic AI systems. When AI agents combine access to private data, exposure to untrusted content, and channels to send data out — the “lethal trifecta” — they can be weaponized by a single poisoned comment. For enterprises, the lesson is clear: AI automation requires continuous visibility, not just one‑time audits.