# a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker: A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP)

> A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP) is a high-severity prompt injection issue in Azure DevOps MCP server, a MCP server. Affected: Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned..

- **Canonical URL:** https://catalog.anomity.ai/vuln/a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker
- **Aliases:** ti-087
- **Severity:** high
- **Attack type:** Prompt injection, Data exfiltration
- **Component:** Azure DevOps MCP server (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-07-22
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker

## Summary

Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull-request descriptions verbatim through repo_get_pull_request_by_id, with none of the delimiter "spotlighting" Microsoft's own guidance recommends for untrusted content. Because Azure DevOps renders Markdown, instructions hidden inside an HTML comment are invisible to every human reading the PR in the web UI and returned in full to any agent that reads it through the API. In the proof of concept an agent asked to review the PR approved it, triggered a pipeline in a different project, read a confidential wiki page and posted the contents back as a PR comment. The researchers reproduced it against both Copilot CLI and Claude Code, which places the defect in the MCP server's handling of untrusted data rather than in one model or client. MSRC triaged the report but no CVE and no fixed release existed at the 22 July write-up: 2.7.0 was confirmed vulnerable and 2.8.0, shipped 24 June 2026, was still unfixed.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned..

## How do I fix it?

There is nothing to patch, so treat this as a permissions problem. What bounds the damage is the reviewer agent's own token, not the attacker's access, so an agent holding broader permissions than the person opening the PR IS the vulnerability: scope its PAT to a single project and load only the tool domains a review actually needs (the -d flag). Take pipeline runs, wiki reads and comment posting out of any code-review tool set. Then detect it: alert on cross-project calls in agent tool traces during a review, and scan PR descriptions for HTML comments, which a human reviewer cannot see by definition.

## How do I find every machine running Azure DevOps MCP server?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Azure DevOps MCP server and which version, then enforce a policy on it.

## References

- article: https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html

## Related vulnerabilities

- [ghostsplice-malicious-mcp-servers-split-one-instruction-across-two](https://catalog.anomity.ai/vuln/ghostsplice-malicious-mcp-servers-split-one-instruction-across-two) — high
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high
- [CVE-2026-108592](https://catalog.anomity.ai/vuln/cve-2026-108592) — high
- [cryptographic-context-injection-an-encrypted-web-page-got-github](https://catalog.anomity.ai/vuln/cryptographic-context-injection-an-encrypted-web-page-got-github) — medium
- [CVE-2026-104120](https://catalog.anomity.ai/vuln/cve-2026-104120) — medium

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker