Microsoft's official Azure DevOps Model Context Protocol (MCP) server contains a prompt injection vulnerability that allows attackers to hijack AI code review agents through hidden pull request comments. A single invisible comment injected into a pull request description enables attackers to redirect an AI reviewer agent into unauthorized projects and exfiltrate sensitive data without triggering detection.
The flaw stems from the MCP server's pull request description tool, which returns PR content without implementing adequate prompt-injection safeguards. When an attacker crafts a malicious comment embedded in a PR, the agent processes the hidden instruction as part of its normal workflow. This allows the attacker to manipulate the AI into accessing repositories outside its intended scope, circumventing Azure DevOps permission controls.
The attack chain works because developers often trust AI review agents with repository access. An attacker with minimal or no permissions to a target project can create a PR in any repository they do have access to, embed an invisible prompt injection command, and wait for an AI reviewer to process it. Once triggered, the compromised agent becomes an unwitting proxy for lateral movement and data theft.
The vulnerability poses particular risk to organizations using AI-powered code review workflows across multiple repositories. Attackers gain access to source code, secrets embedded in repositories, configuration details, and proprietary logic that the compromised agent encounters. The stealthy nature of invisible comments means organizations may never realize their agents have been exploited.
Microsoft's MCP server documentation appears to have been designed with prompt injection mitigations in mind, but implementation gaps left the pull request description endpoint unprotected. This represents a significant gap between security design and execution in a tool marketed for enterprise DevOps automation.
Organizations using Azure DevOps MCP servers with AI agents should immediately review their MCP implementations, restrict agent permissions to only essential repositories, and monitor agent activity logs for suspicious repository access patterns. Microsoft should issue