Azure DevOps MCP prompt injection: are your agents keeping up?

TL;DR: A hidden HTML comment in Azure DevOps can steer an AI agent into cross-project actions it would never take on its own, according to Manifold Security, because the official Azure DevOps MCP server passes untrusted pull request content straight into the agent’s context. The result is a confused-deputy pattern that turns the victim’s credentials into a data-exfiltration channel.

Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft's Azure DevOps MCP Server”.

Key questions

Q: What breaks when an AI agent reads attacker-controlled PR text and can act on it?

A: The control that breaks is the assumption that review content is passive.

Q: Why do AI agents create more risk than ordinary automation in pull request workflows?

A: Because an agent does not just execute a fixed script.

Q: What are the signs that prompt injection is reaching an AI agent through developer workflows?

A: Look for tool calls that do not match the user’s apparent request, especially when a review task leads to pipeline execution, wiki reads, or cross-project access.

Practitioner guidance

• Map agent read and write paths Inventory every place an AI agent can consume attacker-writable content and then invoke a privileged tool, especially PRs, issues, comments, and wiki pages.
• Separate instructions from data Require content boundaries such as explicit untrusted-content wrappers before the agent can interpret text that came from another user or project.
• Scope delegated permissions per task Reduce the blast radius of reviewer credentials so a single review session cannot reach unrelated projects, pipelines, or confidential knowledge bases.

Bottom line: Hidden instructions in attacker-writable developer content can steer an AI agent into privileged actions without any visible sign to the human reviewer.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →