Reported by 1 outlet
Azure DevOps MCP Confused-Deputy Flaw: Hidden PR Comments Hijack AI Code-Review Agents — No Fix, No CVE
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Azure DevOps MCP Confused-Deputy Flaw: Hidden PR Comments Hijack AI Code-Review Agents — No Fix, No CVE
thehackernews.com · 73d ago · August 2nd, 2026
Manifold Security disclosed a confused-deputy vulnerability in Microsoft's official Azure DevOps Model Context Protocol (MCP) server that lets an attacker hijack AI coding/review agents. An attacker embeds instructions in a pull request description as HTML comments — invisible in the Azure DevOps web UI but returned verbatim by the REST API. When a developer's AI agent reads the PR, the hidden instructions take over the session: the agent can silently approve malicious changes, trigger pipelines in unrelated projects, and exfiltrate source code, secrets, and wiki content back to the attacker as a PR comment. No fix and no CVE assigned as of publication; Microsoft has acknowledged the issue and is working on patches.
Why it matters: This is the same indirect-prompt-injection pattern as this week's Copilot Word worm (below) applied to the CI/CD plane — a poisoned artifact inside the normal developer workflow converts trusted AI tooling into an exfiltration channel. It is a live risk for every team running AI coding agents against Azure DevOps.
Action: Inventory AI coding agents connected to Azure DevOps MCP; restrict MCP tool scopes to the minimal project set; treat PR descriptions as untrusted input; monitor for agent-initiated PR comments, pipeline triggers, and outbound data patterns.