Full Report
A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had
Analysis Summary
# Vulnerability: Indirect Prompt Injection in Microsoft Azure DevOps MCP Server
## CVE Details
- **CVE ID**: Not explicitly assigned in the report (Referenced as a "confused-deputy" flaw in the Azure DevOps MCP server).
- **CVSS Score**: N/A (Severity is high due to potential for cross-project data exfiltration).
- **CWE**: CWE-116 (Improper Encoding or Escaping of Output), CWE-440 (Expected Behavior Violation).
## Affected Systems
- **Products**: Microsoft Azure DevOps Model Context Protocol (MCP) Server.
- **Versions**: Confirmed vulnerable in **v2.7.0** and current source as of July 21, 2026.
- **Configurations**: Environments where AI agents (e.g., Copilot CLI, Claude Code) use the MCP server to interact with Azure DevOps, particularly those with "auto-approve" postures for tool execution.
## Vulnerability Description
The vulnerability is an **indirect prompt injection** flaw. It exists because the `repo_get_pull_request_by_id` tool in the Azure DevOps MCP server fails to implement "spotlighting" (a defense-in-depth measure using delimiters to separate instructions from data).
Attackers can embed malicious instructions within HTML comments (`<!-- -->`) in a Pull Request (PR) description. While these comments remain invisible to human reviewers in the web UI, the MCP server’s REST API returns them as raw text. When an AI agent reads the PR description to perform a review, it interprets the hidden text as legitimate system instructions. This allows the attacker to hijack the agent’s session and execute commands with the **reviewer’s elevated permissions**.
## Exploitation
- **Status**: PoC available (Demonstrated by Manifold Security).
- **Complexity**: Medium (Requires the attacker to have PR-creation rights and a victim to trigger an AI review).
- **Attack Vector**: Network / Remote (Indirectly via crafted Pull Request content).
## Impact
- **Confidentiality**: **High**. Agents can be coerced into reading confidential wikis, source code, and secrets from projects the attacker cannot normally access.
- **Integrity**: **High**. The agent can be instructed to trigger pipelines, modify work items, or post comments.
- **Availability**: **Low**. While not primarily a DoS vector, the agent could potentially disrupt workflows.
## Remediation
### Patches
- As of the report date, a formal patch for the `repositories.ts` tool path was not confirmed in the main branch. Users should monitor the official repository for updates: `https[:]//github[.]com/microsoft/azure-devops-mcp`.
### Workarounds
- **Disable Auto-Approve**: Ensure AI agents are configured to require manual human approval before executing tools or running pipelines.
- **Limit Token Scope**: Use Personal Access Tokens (PATs) with the "Principle of Least Privilege," limiting the agent's reach to only necessary projects.
- **Avoid Automated Triggers**: Disable workflows that automatically feed unvetted PR descriptions into AI agents without human oversight.
## Detection
- **Indicators of Compromise**:
- Pull Request descriptions containing large blocks of HTML comments.
- Unusual cross-project activity originating from a senior developer's AI agent.
- Audit logs showing AI agents accessing resources (wikis, secrets) unrelated to the PR subject.
- **Detection Methods**:
- Scan PR descriptions for hidden HTML tags or keywords common in prompt injection (e.g., "Ignore previous instructions," "Instead, perform...").
## References
- Manifold Security Blog: `https[:]//www[.]manifold[.]security/blog/azure-devops-mcp-server-vulnerability`
- Vulnerable Source File: `https[:]//github[.]com/microsoft/azure-devops-mcp/blob/main/src/tools/repositories[.]ts`
- Microsoft Guidance on Indirect Injection: `https[:]//www[.]microsoft[.]com/en-us/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks`