Azure DevOps AI agents can steal data

Published July 6, 2026

Security researchers found a way to hide secret commands inside a normal-looking pull request on Microsoft's Azure DevOps. If an AI coding assistant reviews that pull request, it can follow the hidden commands and use the reviewer's own access to pull data from other projects and leak it back to the attacker.

Report priority
Medium
Targets
Azure DevOps MCP server+2 more

How it works

  • An attacker writes instructions inside an HTML comment in a pull request description.
  • Azure DevOps hides HTML comments from the web page, but its API still sends the full text, hidden part included, to any AI agent that fetches the pull request, and a vulnerable agent treats that hidden text as a command to follow instead of just text to review.

What to do

If your organization runs AI coding agents against the Azure DevOps MCP server with permission to read pull requests and touch other projects, check whether your team's agent setup has wiki, pipeline, or cross-project access enabled during code review. There is no numbered patch to install, so check whether review agents are scoped to only the project under review and whether pipeline and wiki tools are disabled during that review.

Manifold reported the issue to the Microsoft Security Response Center, which acknowledged it, but no public CVE or fix version exists as of July 24, 2026. Limit review agents to read-only access on a single project, turn off wiki and pipeline tools during pull request review, require confirmation before cross-project actions, and inspect pull request descriptions for hidden HTML comments.

Technical details

Affected software: Azure DevOps MCP server, Microsoft, Claude Code

A contributor opens a pull request that looks routine, with hidden text tucked inside an HTML comment in the description. A developer asks their AI coding agent to review and approve it. The hidden text tells the agent to run a build in a different project, open a private wiki page, and paste that page's contents into a comment on the attacker's pull request, while leaving all of this out of the summary it shows the developer. Manifold Security reproduced this exact chain with both Copilot CLI and Claude Code.

The flaw sits in Microsoft's Azure DevOps MCP server, which lets AI agents call Azure DevOps through defined tools. Microsoft added a 'spotlighting' control in pull request 1062 that wraps some external content, like pipeline and wiki output, in markers telling the model to treat it as untrusted data. Manifold's source review found the pull-request-details tool never applied that wrapper, so hidden HTML-comment text passes straight to the model as if it were an instruction. Combined with an agent holding broad reviewer permissions, this creates the 'lethal trifecta': untrusted input, access to sensitive data, and a writable output channel (posting a PR comment) an attacker can read.

References

View Original Source