Azure DevOps Flaw Exposes AI Code Review Agents to Hijacking
A vulnerability in Microsoft's Azure DevOps MCP allows attackers to hijack AI reviewers through hidden pull request comments. This can lead to unauthorized access and data leakage across projects.
TL;DR
- An invisble PR comment can hijack Microsoft's AI code review agent in Azure DevOps.
- The flaw exists in the official MCP server due to missing prompt-injection safeguards.
- Attackers can gain access to projects they don't have permissions for.
- Sensitive project data could be leaked silently during the compromised review process.
- Organizations using Azure DevOps AI agents should audit their MCP configurations immediately.
Security researchers have uncovered a critical flaw in Microsoft's Azure DevOps platform that allows malicious actors to compromise AI-powered code review agents. By embedding a specially crafted, invisible comment in a pull request, attackers can manipulate the behavior of Microsoft's official Model Coordination Protocol (MCP) server.
This manipulation tricks the AI reviewer into performing actions beyond its intended scope, including accessing repositories and projects the attacker has no legitimate rights to view. The vulnerability stems from inadequate input sanitization in one of the MCP's core tools, specifically its handling of pull request descriptions.
Because the exploit occurs within the trusted context of an automated code review workflow, it can operate under the radar, potentially exfiltrating sensitive code or project metadata without triggering traditional security alerts.
How the Attack Works
- Attackers inject a hidden or obfuscated comment into a pull request description field.
- The Azure DevOps MCP server processes this input without sufficient prompt-injection defenses.
- The compromised AI agent then performs unintended operations on behalf of the reviewer.
- These operations can include reading files, listing directories, or accessing other repositories.
- Data gathered by the agent may be sent back to the attacker-controlled endpoint.
Impact and Mitigation
- Organizations using Azure DevOps' AI-assisted code reviews are potentially exposed.
- Projects with public or broad internal contribution access are at higher risk.
- Reviewers who use AI agents connected to the MCP server are most vulnerable.
- Microsoft has acknowledged the issue but has not yet released a patch as of publication.
- Teams should disable or restrict AI agent integrations until mitigations are applied.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.