Azure DevOps MCP Server Lets Hidden PR Comments Hijack AI Review Agents

Microsoft's official Azure DevOps MCP server (tested at v2.7.0; v2.8.0 was current as of June 24, 2026), driving agents including GitHub Copilot CLI and Claude Code

An attacker with write access to a single project plants an HTML comment in a pull request description. The comment is invisible in the Azure DevOps web interface but is returned verbatim by the API, so when a reviewer asks an AI agent to review the PR, the hidden text rewrites the agent's objectives. The agent then acts with the reviewer's credentials, reaching projects the attacker has no rights to and quietly returning source code, secrets, and work items. No fixed release was available at disclosure and no exploitation outside the researchers' testing was reported

Microsoft applied a spotlighting defense that wraps untrusted content via a `createExternalContentResponse` helper, but the pull request retrieval path `repo_get_pull_request_by_id` never calls it, so PR descriptions reach the model unwrapped. The defense existed and was simply not applied consistently across tools. Reported by Manifold Security