Executive Summary
An invisible comment in an Azure DevOps pull request can hijack a reviewer's AI coding agent through Microsoft's official Azure DevOps MCP server, sending it into projects the attacker cannot access and leaking what it finds.
What Happened
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had
Affected Products
- Azure DevOps MCP server
Vulnerability / Attack Technique
Prompt injection via PR descriptions through an MCP tool
Technical Mechanism
One MCP tool returns PR descriptions without the prompt-injection guardrail Microsoft applied elsewhere, so hidden instructions reach the agent.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Part of the MCP Security topic.
Relevant Frameworks
RealGround Analysis
The reviewer's broader access becomes the attacker's. RealGround analysis: AI review agents should run with the PR author's permissions, not the reviewer's.
Recommended Controls
- Update the Azure DevOps MCP server
- Scope review agents to the PR's project
- Treat PR text as untrusted input
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.