A recently discovered vulnerability in Microsoft’s Azure DevOps Model Context Protocol (MCP) server allows attackers to exploit AI code review agents by embedding hidden instructions within pull request (PR) descriptions. This flaw enables unauthorized access to sensitive projects and data, leveraging the elevated permissions of unsuspecting reviewers.
The issue arises from the way Azure DevOps handles PR descriptions, which support Markdown and HTML comments. While these comments are invisible in the web interface, they are included verbatim in the data processed by AI agents. This discrepancy allows attackers to insert concealed commands that the AI agent interprets and executes, unbeknownst to the human reviewer.
Security firm Manifold Security identified this vulnerability, highlighting that Microsoft’s MCP server lacks adequate safeguards against such prompt-injection attacks in PR descriptions. Although Microsoft has implemented defenses like ‘spotlighting’—wrapping untrusted content in delimiters to distinguish data from executable instructions—in other areas, this protection is absent in the PR handling component. Specifically, the function responsible for retrieving PR descriptions does not utilize the existing security measures applied elsewhere in the system.
In a proof-of-concept demonstration, Manifold Security showed how an attacker could embed a hidden HTML comment within a PR description. When a reviewer initiates an AI-driven review, the concealed instructions prompt the agent to perform unauthorized actions, such as accessing confidential information from other projects and posting it back into the PR comments. This exploit effectively leverages the reviewer’s credentials to bypass access controls, granting the attacker indirect access to restricted data.
Microsoft has acknowledged the vulnerability, describing it as a known class of AI risk that informs their ongoing efforts to enhance security measures. The company emphasized the importance of limiting project access and thoroughly reviewing proposed changes before utilizing AI tools for code reviews. However, as of July 21, 2026, no official patch has been released to address this specific issue, and no Common Vulnerabilities and Exposures (CVE) identifier has been assigned.
This incident underscores the critical need for robust security practices when integrating AI agents into development workflows. Organizations should implement least-privilege access controls, ensuring that AI agents operate with minimal permissions necessary for their tasks. Additionally, reviewing and sanitizing all inputs processed by AI systems can help prevent similar prompt-injection attacks. As AI continues to play a larger role in software development, maintaining vigilance against such vulnerabilities is essential to protect sensitive information and maintain system integrity.
