A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP)
A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP) is a high-severity prompt injection issue in Azure DevOps MCP server, a MCP server. Affected: Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned..
Is Azure DevOps MCP server running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker- Severity
- high
- Attack type
- Prompt injection, Data exfiltration
- Component
- Azure DevOps MCP server · MCP server
- Known exploited
- No known exploitation
- Public exploit
- Yes
- Published
- Last verified
What is this vulnerability?
Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull-request descriptions verbatim through repo_get_pull_request_by_id, with none of the delimiter "spotlighting" Microsoft's own guidance recommends for untrusted content. Because Azure DevOps renders Markdown, instructions hidden inside an HTML comment are invisible to every human reading the PR in the web UI and returned in full to any agent that reads it through the API. In the proof of concept an agent asked to review the PR approved it, triggered a pipeline in a different project, read a confidential wiki page and posted the contents back as a PR comment. The researchers reproduced it against both Copilot CLI and Claude Code, which places the defect in the MCP server's handling of untrusted data rather than in one model or client. MSRC triaged the report but no CVE and no fixed release existed at the 22 July write-up: 2.7.0 was confirmed vulnerable and 2.8.0, shipped 24 June 2026, was still unfixed.
Affected versions
| Affected | Fixed in |
|---|---|
Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned. | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned..
How do I fix it?
There is nothing to patch, so treat this as a permissions problem. What bounds the damage is the reviewer agent's own token, not the attacker's access, so an agent holding broader permissions than the person opening the PR IS the vulnerability: scope its PAT to a single project and load only the tool domains a review actually needs (the -d flag). Take pipeline runs, wiki reads and comment posting out of any code-review tool set. Then detect it: alert on cross-project calls in agent tool traces during a review, and scan PR descriptions for HTML comments, which a human reviewer cannot see by definition.
How do I find every machine running Azure DevOps MCP server?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Azure DevOps MCP server and which version, then enforce a policy on it.