Researchers at Manifold Security disclosed a vulnerability in Microsoft's Azure DevOps MCP server where HTML comments hidden in pull request descriptions can be used to hijack AI coding agents via prompt injection. The flaw exists because the PR retrieval tool, unlike wiki and build log tools, does not wrap untrusted content in delimiters, so hidden instructions reach the model as trusted text. An attacker with write access to one repo can exploit a victim's agent to traverse the entire organization using the victim's permissions. Practical mitigations include scoping PATs to single projects, restricting MCP tool domains to only what the task requires, requiring human approval for cross-project actions, and logging agent activity. No CVE or patch exists yet. The broader lesson applies to any MCP server that feeds agent-readable content authored by untrusted parties.
