Microsoft/azure-devops-mcp has a security flaw

Published July 6, 2026

A bug in Microsoft's Azure DevOps lets attackers hide commands in pull request comments. When an AI coding assistant reads those comments, it can secretly steal data from projects the attacker can't normally access.

Report priority
Medium
Targets
Azure DevOps MCP server+1 more

How it works

  • An attacker adds a hidden HTML comment in a pull request description.
  • The AI coding assistant reads it as a secret command and follows it without the developer noticing.

What to do

Check if you use Azure DevOps MCP server and have AI coding assistants enabled in your projects. If you do, monitor Microsoft's official updates for a patch or workaround.

In the meantime, avoid reviewing pull requests from unknown contributors.

Technical details

Affected software: Azure DevOps MCP server, Microsoft

An attacker joins a team's Azure DevOps project. They create a pull request with a hidden comment in the description. When a developer asks the AI assistant to review that pull request, the assistant secretly reads the hidden comment. The comment tells the assistant to copy sensitive data from another project and send it back to the attacker. The developer never sees the hidden command or the stolen data.

A security flaw in Microsoft's Azure DevOps MCP server (tracked as NEWS-b6b2e97b48d41876ff) allows attackers to abuse pull request (PR) descriptions for indirect prompt injection. Since Azure DevOps supports Markdown in PR comments, malicious actors can embed hidden HTML comments, visible only to the API, not the UI, that instruct the AI coding assistant to perform unauthorized actions under a victim's credentials. The agent, acting as a "confused deputy," can approve PRs, trigger pipelines, read confidential wiki pages, or exfiltrate data from projects the attacker lacks direct access.

The vulnerability stems from an incomplete fix: while "spotlighting" (delimiter-based content isolation) was applied to pipeline and wiki tools, it was not extended to PR descriptions, leaving this attack vector open. Researchers at Manifold Security demonstrated the exploit in a proof-of-concept where stolen data was posted as a PR comment under the attacker's control.

References

View Original Source