A vulnerability in Microsoft's official Azure DevOps Model Context Protocol (MCP) server allows a single invisible comment in a pull request to turn a reviewer's own AI coding agent against them. The flaw, detailed by offensive security firm Manifold, enables attackers to hijack the agent's credentials and access projects and data they have no rights to see.
The problem lies in how the MCP server handles PR descriptions. The server uses Markdown, which allows for HTML comments that are rendered invisible in the web UI. However, the REST API returns these comments verbatim, feeding them directly to the AI agent. When a reviewer asks their agent to review the PR, the hidden text can rewrite the agent's goal, allowing it to act across projects the attacker cannot access, potentially reaching source code, secrets, and work items.
A Missing Guardrail
The attack is particularly dangerous because Microsoft had already shipped a defense for this exact scenario. The company added a technique called 'spotlighting' to wrap untrusted content in delimiters so the model can distinguish data from instructions. However, the tool that returns pull request details (repo_get_pull_request_by_id) never calls this shared helper, leaving the description raw.
In Manifold's proof of concept, a single hidden comment drove a chain of events where the agent triggered a pipeline in a different project, read a confidential wiki page, and posted it back as a comment on the PR, where the attacker could read it. The team reproduced it with both Copilot CLI and Claude Code, indicating it is not tied to one specific agent.
Autonomous Risks
While the demo assumes a person kicks off the review, Manifold noted that teams are heading toward automated review and triage fired by triggers. In that scenario, the planted description fires on its own, and the leak runs longer before anyone notices. Microsoft has acknowledged the issue as "a known class of AI risk" and is working on safeguards but has not assigned a CVE or announced a fix as of July 21.
The recommended defenses include giving the agent least-privilege tokens, scoping it to the project under review, and restricting its access to only the necessary tools. Organizations are advised to scan open PR descriptions for hidden HTML comments and monitor tool traces for cross-project activities.