A new report from **Manifold Security** details a significant 'confused deputy' vulnerability within **Microsoft's Azure DevOps MCP server**. This flaw exploits the interaction between human-readable content and AI agent processing, allowing malicious actors to orchestrate data exfiltration through seemingly innocuous pull requests. The core of the issue lies in how the **Azure DevOps MCP server** handles pull request descriptions. While the web UI renders HTML comments (`<!-- ... -->`) as invisible, the underlying REST API returns this content verbatim. Crucially, the server then feeds this raw text directly to an AI agent without applying a prompt-injection guardrail that **Microsoft** has implemented for other tools. ### The Invisible Threat: How it Works An attacker can embed hidden instructions within an HTML comment in a pull request description. When a reviewer initiates their AI agent to review the PR, the agent, operating with the reviewer's elevated credentials, unknowingly processes these hidden commands. This allows the attacker to redirect the agent's actions, potentially accessing source code, secrets, and work items in projects they do not have direct access to. **Manifold Security** demonstrated this with a proof-of-concept. An attacker contributing to one project opened a PR with a hidden payload. Upon agent review, the tool trace triggered a pipeline in a different project, read a confidential wiki page the attacker couldn't access, and posted that page back as a comment on the PR for the attacker to read.  ### A Missed Guardrail What makes this vulnerability particularly notable is that **Microsoft** had already developed a defense mechanism: 'spotlighting.' This technique, detailed in **Microsoft's** own guidance on indirect prompt injection, involves wrapping untrusted content in delimiters to differentiate data from instructions. This was implemented in **PR #1062** for wiki-page and build-log tools, but the `repo_get_pull_request_by_id` tool, responsible for pull request descriptions, was overlooked. As of July 21, the source code for **Azure DevOps MCP server** still shows this path uncovered, confirming the vulnerability remains active. The exploit has been reproduced with both **Copilot CLI** and **Claude Code**, indicating it's not agent-specific. ### Prerequisites and Broader Implications The attack chain requires several conditions: attacker-written PR text, a workflow that feeds it to an agent, a reviewer with higher access than the attacker, and an agent configured for auto-approval without per-tool prompts. The latter, an 'auto-approve posture,' concentrates the risk significantly. **Manifold Security** warns that as development teams move towards automated review, triage, and summaries, the potential for these hidden instructions to trigger without human intervention increases, leading to more prolonged and unnoticed data leaks. This pattern is not new. In May 2025, **Invariant Labs** demonstrated a similar attack against **GitHub's MCP server**, highlighting the 'lethal trifecta' described by **Simon Willison**: an agent with access to private data, exposure to untrusted content, and a way to exfiltrate data. Most useful agents, by design, possess all three attributes. ### Microsoft's Response and Mitigation A **Microsoft** spokesperson acknowledged the report, calling it a 'known class of AI risk' that informs their ongoing safeguard development. They noted the attack requires an attacker to have write access to a project and a second user to invoke an AI tool. **Microsoft** recommends limiting project access and reviewing proposed changes before AI tool invocation. However, the core challenge remains that the payload is invisible to a human reviewer. As of July 21, no fix has been released, and no **CVE** has been assigned. The latest release, **v2.8.0**, shipped on June 24, with no public reports of this technique in active exploitation outside **Manifold's** testing. While **Manifold** tested only the local, PAT-based server, they suggest the root cause in the server's code implies the hosted **remote MCP server** is also exposed, though this was not directly tested. ### Recommendations for Security Professionals To mitigate this risk, security professionals should: * **Implement Least Privilege**: Configure AI agents with the minimum necessary permissions, scoping them strictly to the project under review. * **Limit MCP Domains**: Restrict the **MCP** domains loaded to only those essential for the task, using flags like `-d` for local servers. * **Restrict Tool Access**: Ensure code-review tools do not have access to unrelated functionalities like pipeline runs, wiki reads, or comment posting. * **Audit Agent Traces**: Regularly review agent tool traces for suspicious cross-project pipeline runs, wiki reads, or comments posted during reviews. * **Scan for Hidden Comments**: Actively scan open pull request descriptions for hidden HTML comments, as human review alone is insufficient. The effectiveness of 'spotlighting' and similar guardrails relies on their consistent application across all potential input paths. Overlooking a single function can create a significant vulnerability, especially as AI tool surfaces continue to expand rapidly.