Azure DevOps Flaw Lets Hidden PR Comments Hijack AI Agents

A critical vulnerability has been identified in Microsoft's Azure DevOps MCP server, enabling attackers to hijack AI coding review agents through hidden comments within pull requests. This flaw allows an attacker to inject malicious instructions into a pull request description, which, when processed by the AI agent, can cause it to access and exfiltrate data from projects it should not have permission to reach. The exploit leverages the absence of prompt-injection guardrails in a specific tool within the Azure DevOps MCP server that processes pull request descriptions.

When a pull request is submitted, the AI agent is designed to review code changes. However, by embedding specially crafted, invisible comments within the pull request's description field, an attacker can trick the AI agent into executing unintended commands. These commands can direct the AI to explore directories or access files outside the scope of the approved code review. The AI agent, operating under the guise of legitimate review, then becomes an unwitting tool for data exfiltration, potentially leaking sensitive information to the attacker.

Microsoft has acknowledged the issue and is working on a fix. The company stated that the vulnerability affects the Azure DevOps MCP server and that they are implementing additional security measures to prevent such prompt injection attacks. While the exact timeline for a patch has not been disclosed, users are advised to be vigilant about the content of pull requests and the behavior of their AI review tools. This incident highlights the growing risks associated with AI agents in development workflows and the importance of robust security protocols to prevent their misuse.