Azure DevOps MCP flaw: hidden PR comments hijacking AI code-review agents
> In short: A flaw in Microsoft's Azure DevOps MCP server let a hidden pull-request comment manipulate the AI code-review agents that consume it. By planting a comment an agent would read but a human reviewer would likely miss, an attacker could instruct the agent to approve malicious changes, ignore dangerous code, or leak repository content. It is a concrete instance of the prompt-injection risk on the Model Context Protocol (MCP) layer that now connects AI agents to developer infrastructure.
Why this matters to you
MCP (Model Context Protocol) has become the standard way AI agents reach external tools — repositories, ticketing, databases, internal APIs. If your engineering team uses Copilot, Cursor, Claude Code, or any agent that reads pull requests or tickets, MCP is plausibly in the path. The Azure DevOps MCP server is one of the most-deployed such integrations.
The flaw class demonstrated here is not specific to Microsoft. It is the core prompt-injection problem applied to a high-trust dev tool: any data source the agent reads becomes an instruction channel, and PR comments are attacker-controllable.
The flaw in two sentences
AI code-review agents connected through Azure DevOps MCP read PR comments as part of their context. A hidden comment — collapsed, in a hidden thread, formatted to be skipped by a human but parsed by the agent — could carry instructions that the agent then executed: approve the PR, mark issues as resolved, or summarize and exfiltrate file contents into an outbound channel.
The bug is the missing boundary between *data the agent reads* and *instructions the agent obeys.* The MCP server faithfully passed comment content into the agent's context with no separation, no allow-listing, no taint marking.
Why MCP multiplies the risk
MCP was designed to make tool-calling uniform: one protocol, many servers, any agent. The trade-off is that the same uniformity hands an attacker a generic injection surface. Once an agent reads attacker-controlled data through any MCP server, every tool the agent can call — approve, merge, comment, read file, call webhook — becomes a potential exfiltration or authorization-bypass primitive.
In the dev-workflow context specifically, the agent typically runs with the author's or reviewer's permissions. So a successful injection doesn't just produce a wrong answer — it produces an *authorized* wrong action: a real approval on a real PR, recorded under a real employee's identity.
What to do
approve/merge as agent-callable without an out-of-band confirmation.The pattern
This flaw is the MCP-flavored version of indirect prompt injection, the same class we see on RAG pipelines and chatbot tools. The defense is the same: assume the data layer is hostile, scope the agent's authority to the minimum, and keep the human in the loop on irreversible actions. What's new is that MCP makes the agent's reach broad and uniform — which means the same injection now reaches your repositories, your tickets, and your CI/CD in one protocol.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
AI Agents and Function Calling: Why Tool Use Is the New Attack Surface
AI agents that call tools (APIs, databases, file systems) via function calling open critical vulnerabilities. Analysis and defenses.
ChatGPT AgentForger: one phishing link deploying a rogue AI agent with employee access
A CSRF flaw in OpenAI ChatGPT Workspace Agents (codenamed AgentForger by Zenity) let a single phishing link silently build, authorize, and deploy an autonomous AI agent inside a victim organization, with approvals switched off. Fixed by OpenAI on June 8, 2026.
MCP Security: What to Audit When Your AI Talks to Your Database
The Model Context Protocol (MCP) connects LLMs to your internal tools. Critical audit points to secure these connections.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.