--- title: Azure DevOps MCP Flaw: How to Lock Down Your AI Review... description: Researchers at Manifold Security disclosed a vulnerability in Microsoft's Azure DevOps MCP server where HTML comments hidden in pull request descriptions can... canonical: https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It | daily.dev og:description: Researchers at Manifold Security disclosed a vulnerability in Microsoft's Azure DevOps MCP server where HTML comments hidden in pull request descriptions can... og:url: https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z og:image: https://api.daily.dev/og/posts/7JFkLlz1z.png og:image:alt: Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It **[Latest Hacking News](https://daily.dev/sources/lhn)** · 5 min read · 0 upvotes · 0 comments ## Summary Researchers at Manifold Security disclosed a vulnerability in Microsoft's Azure DevOps MCP server where HTML comments hidden in pull request descriptions can be used to hijack AI coding agents via prompt injection. The flaw exists because the PR retrieval tool, unlike wiki and build log tools, does not wrap untrusted content in delimiters, so hidden instructions reach the model as trusted text. An attacker with write access to one repo can exploit a victim's agent to traverse the entire organization using the victim's permissions. Practical mitigations include scoping PATs to single projects, restricting MCP tool domains to only what the task requires, requiring human approval for cross-project actions, and logging agent activity. No CVE or patch exists yet. The broader lesson applies to any MCP server that feeds agent-readable content authored by untrusted parties. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Azure DevOps MCP server prompt injection vulnerability work? An attacker hides instructions inside a pull request description using an HTML comment, which Azure DevOps renders as invisible in the web interface but Microsoft's official Azure DevOps MCP server returns verbatim to an AI agent. The specific tool that retrieves a pull request by id lacks the delimiter-based protection already applied to the server's wiki and build-log tools, so hidden text reaches the model as trusted instructions rather than data. _Teams wiring AI agents into Azure DevOps can track emerging MCP security guidance on daily.dev before rolling out similar integrations._ ### What permissions does a hijacked AI coding agent gain in this Azure DevOps attack? A hijacked agent keeps acting as the authenticated victim, so it inherits that person's real permissions across the entire organisation rather than being limited to the single repository the attacker had write access to. This lets a successful hijack reach pipelines, wikis, and repositories far outside the pull request where the malicious comment was planted. _Engineers scoping tokens for AI agents can weigh real-world hijack scenarios like this via daily.dev before granting org-wide access._ ### How can I mitigate the Azure DevOps MCP prompt injection flaw before Microsoft patches it? Scope personal access tokens to a single project instead of the whole organisation, load only the MCP tool groups a task actually needs (a review-only agent does not need pipeline or wiki access), require human confirmation for actions crossing project boundaries, and log agent activity for anomalies like unexpected pipeline triggers. Manifold Security's proof of concept worked against both GitHub Copilot CLI and Claude Code, and no CVE or patch existed as of publication. _Anyone locking down AI review agents can follow practical MCP hardening steps like these surfaced on daily.dev._ ## Similar posts on daily.dev - [MCP Security: Understanding Vulnerabilities in Model Context Protocol](https://daily.dev/posts/mcp-security-understanding-vulnerabilities-in-model-context-protocol-hcscknky1) · marmelab · 4 upvotes · 0 comments - [\[Webinar\] Securing Agentic AI: From MCPs and Tool Access to Shadow API Key Sprawl](https://daily.dev/posts/webinar-securing-agentic-ai-from-mcps-and-tool-access-to-shadow-api-key-sprawl-hokzzedlq) · The Hacker News · 0 upvotes · 0 comments - [GitHub builds an immune system for AI coding agents running on MCP](https://daily.dev/posts/github-builds-an-immune-system-for-ai-coding-agents-running-on-mcp-kbo1bxvmn) · The New Stack · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#azure-devops](https://daily.dev/tags/azure-devops) [View this post on daily.dev](https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It","url":"https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z"},"datePublished":"2026-07-26T19:12:35.311Z","dateModified":"2026-09-14T06:15:48.915Z","description":"Researchers at Manifold Security disclosed a vulnerability in Microsoft's Azure DevOps MCP server where HTML comments hidden in pull request descriptions can...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba2df1198e2ff398c6493932f2418e2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba2df1198e2ff398c6493932f2418e2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,mcp,prompt-injection,azure-devops","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"Azure DevOps MCP Flaw: How to Lock Down Your AI Review Agent Before Microsoft Patches It"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/azure-devops-mcp-flaw-how-to-lock-down-your-ai-review-agent-before-microsoft-patches-it-7jfkllz1z#faq","mainEntity":[{"@type":"Question","name":"How does the Azure DevOps MCP server prompt injection vulnerability work?","acceptedAnswer":{"@type":"Answer","text":"An attacker hides instructions inside a pull request description using an HTML comment, which Azure DevOps renders as invisible in the web interface but Microsoft's official Azure DevOps MCP server returns verbatim to an AI agent. The specific tool that retrieves a pull request by id lacks the delimiter-based protection already applied to the server's wiki and build-log tools, so hidden text reaches the model as trusted instructions rather than data. Teams wiring AI agents into Azure DevOps can track emerging MCP security guidance on daily.dev before rolling out similar integrations."}},{"@type":"Question","name":"What permissions does a hijacked AI coding agent gain in this Azure DevOps attack?","acceptedAnswer":{"@type":"Answer","text":"A hijacked agent keeps acting as the authenticated victim, so it inherits that person's real permissions across the entire organisation rather than being limited to the single repository the attacker had write access to. This lets a successful hijack reach pipelines, wikis, and repositories far outside the pull request where the malicious comment was planted. Engineers scoping tokens for AI agents can weigh real-world hijack scenarios like this via daily.dev before granting org-wide access."}},{"@type":"Question","name":"How can I mitigate the Azure DevOps MCP prompt injection flaw before Microsoft patches it?","acceptedAnswer":{"@type":"Answer","text":"Scope personal access tokens to a single project instead of the whole organisation, load only the MCP tool groups a task actually needs (a review-only agent does not need pipeline or wiki access), require human confirmation for actions crossing project boundaries, and log agent activity for anomalies like unexpected pipeline triggers. Manifold Security's proof of concept worked against both GitHub Copilot CLI and Claude Code, and no CVE or patch existed as of publication. Anyone locking down AI review agents can follow practical MCP hardening steps like these surfaced on daily.dev."}}]} ```