Hidden PR comment can hijack Azure DevOps AI reviews
A hidden comment in an Azure DevOps pull request can trick a reviewer's AI agent into reading files it should not touch. The agent then acts under the reviewer's own account, reaching projects the attacker could never open directly.
- Report priority
- Medium
- Targets
- Azure DevOps MCP server+2 more
How it works
One server tool, repo_get_pull_request_by_id, hands the reviewer's agent a pull request description exactly as written, skipping the delimiter safeguard other tools already use to mark outside text as untrusted.
What to do
Check whether you connect an AI agent such as Copilot CLI or Claude Code to Microsoft's Azure DevOps MCP server, and whether that agent runs in auto-approve mode without asking before cross-project actions.
Turn off auto-approve and require per-tool confirmation before your agent runs pipelines or reads wiki pages during a PR review. Treat pull request descriptions as untrusted text rather than safe instructions. Watch the Azure DevOps MCP server repository and release notes for a fix, since no patched version exists yet.
Technical details
Affected software: Azure DevOps MCP server, Microsoft Azure DevOps, Claude Code
A contributor opens an ordinary-looking pull request with a hidden HTML comment buried in the description. The reviewer asks their AI agent to review the PR, and the agent reads the hidden text as instructions. It triggers a pipeline run in a separate project, opens a confidential wiki page the contributor cannot access, and posts that page back as a comment on the same PR. Manifold Security reproduced this chain with both Copilot CLI and Claude Code.
The Azure DevOps MCP server tool repo_get_pull_request_by_id returns PR descriptions raw, without passing them through createExternalContentResponse, the spotlighting helper Microsoft added in PR 1062 to delimit untrusted external content for other tools like wiki and build-log readers. An attacker embeds instructions in an HTML comment inside a PR description, invisible in the web UI but returned verbatim by the REST API. When an agent reviews the PR under the reviewer's credentials, it follows the hidden instructions as a confused deputy, chaining calls across projects the attacker cannot access: triggering a pipeline, reading a confidential wiki page, and exfiltrating it via a PR comment. No CVE has been assigned and the gap remained in current source as of July 21, 2026.