Hidden pull request comments can hijack AI agents via Microsoft's DevOps MCP server

Offensive security firm Manifold Security detailed a confused deputy flaw in Microsoft's official Azure DevOps MCP server, which lets AI agents read and operate Azure DevOps on a user's behalf across pull requests, pipelines, wikis, and work items, using that user's own permissions. One of the server's tools returns pull request descriptions without the prompt injection guardrail Microsoft had already applied to other tools. Because descriptions accept Markdown, an attacker can bury instructions in an HTML comment: the web interface renders it as nothing, so a reviewer sees an ordinary change, while the REST API returns the text verbatim and hands it straight to the agent.

Check

Check whether AI agents in your environment use the Azure DevOps MCP server, and review what permissions those agents inherit, since content written by others becomes instructions the agent may act on.

Affected

Teams running AI agents against Azure DevOps through Microsoft's MCP server; a pull request description containing a hidden HTML comment can steer the agent, which acts with the requesting user's full permissions.

Fix

Treat repository and ticket content reaching an agent as untrusted input, scope MCP server permissions well below the user's own, require human approval for write actions, and monitor agent tool calls.