Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack Your AI Review Agent

A Single Invisible Comment Can Redirect Your AI Agent Across Your Entire Org

Microsoft's official Azure DevOps MCP (Model Context Protocol) server contains a prompt injection vulnerability that allows an attacker to embed hidden instructions inside a pull request comment — silently redirecting any connected AI coding agent into repositories and projects the attacker has no direct rights to access.

What Happened

Researchers found that the Azure DevOps MCP server passes PR content to the AI model without sanitizing it for adversarial instructions. An attacker who can post or edit a PR comment — an external contributor, a compromised contractor, anyone with minimal repo access — can craft a payload that instructs the reviewing AI agent to read files from other repositories, harvest secrets, or take actions org-wide. The agent executes these instructions under the authenticated reviewer's permissions, not the PR author's. From the human reviewer's perspective, the session looks completely normal.

This is an indirect prompt injection attack: the malicious payload rides in on content the agent is expected to read, and the agent has no mechanism to distinguish legitimate review context from attacker instructions embedded within it.

Why It Matters

AI code review agents are now embedded in standard dev workflows across thousands of organizations. The blast radius here is not limited to the PR under review — it scales with whatever scope your agent holds. An agent with org-wide read access is a single hidden comment away from becoming a data exfiltration tool targeting every repository you own.

The attack requires no elevated privileges. PR comment access is routinely granted to external contributors and open-source collaborators. Any team that reviews untrusted forks or accepts outside pull requests is exposed today, with no change in workflow required from the attacker.

This also signals a broader shift: as MCP becomes the standard integration layer connecting AI agents to internal systems, the content those agents consume becomes an attack surface. Every document, ticket, and comment your agent reads is now a potential injection vector.

What To Do Right Now

1. Audit your MCP integrations. Identify every AI agent connected to Azure DevOps via MCP and document what repository and org-level permissions it holds.
2. Minimize agent scope immediately. Restrict agents to single-repository access where possible. Remove any org-wide read grants that are not strictly necessary.
3. Suspend AI review on untrusted PRs. Pause AI-assisted review for external contributors, forks, and any PR from a party you do not fully trust — until Microsoft ships a patched MCP server.
4. Watch for the patch. Monitor the The Hacker News coverage and Microsoft's MCP server release notes; deploy the fix the moment it is available.
5. Treat all MCP-retrieved content as untrusted input in any agent you operate. This is the correct security posture regardless of whether this specific flaw is patched.

Do not wait. The attack is trivial to execute and passive from the reviewer's perspective — there is no anomaly to notice until data has already moved.