Summary
- Manifold Security says hidden HTML comments in Azure DevOps pull requests can hijack an AI coding agent’s goal.
- The issue affects Microsoft’s Azure DevOps MCP server, which lets agents act on Azure DevOps content using the user’s permissions.
- The risk is a confused-deputy pattern where an agent misuses a legitimate user’s access across projects.
Manifold Security has disclosed a confused-deputy issue in Microsoft’s Azure DevOps MCP server that can allow hidden pull request instructions to steer an AI coding agent using a reviewer’s own permissions.
The research concerns Microsoft’s official Azure DevOps Model Context Protocol server, which exposes Azure DevOps functions to AI agents. Those agents can read pull requests, pipelines, wikis, work items, and other development platform content on behalf of a user. Manifold’s proof of concept shows that an attacker with access to one project can place instructions inside an HTML comment in a pull request description.
The comment is invisible in the Azure DevOps web interface but returned through the API and passed into the agent’s context. When a reviewer asks an AI agent to review the pull request, the hidden instruction can redirect the agent’s task. Since the agent acts under the reviewer’s identity, it may access other projects that the attacker cannot reach directly.
In Manifold’s proof of concept, the agent read confidential wiki content from another project and posted it back to the attacker’s pull request. Similar paths could expose source code, work items, secrets, or build information, depending on the reviewer’s permissions and the tools available to the agent.
The issue does not require direct credential theft. It works by turning trusted access into a tool for untrusted instructions. That is why the confused-deputy pattern is significant in agentic software development: the user is authorised, the agent is authorised, and the content being read is attacker-controlled.
Manifold says Microsoft had applied a protection known as spotlighting to some Azure DevOps MCP tools, wrapping untrusted content so the model can distinguish data from instructions. The research says that protection was not applied consistently, leaving pull request descriptions as an injection path. Manifold also says Microsoft Security Response Center acknowledged and triaged the report.
AI-assisted development is moving into workflows where agents read code, review pull requests, summarise issues, inspect pipelines, and retrieve documentation. Those workflows require agents to ingest content supplied by other users. When the same agent can call tools, query repositories, access wikis, or post results, ordinary collaboration surfaces become instruction channels.
Human review does not remove the risk where malicious content is hidden from the interface but visible to the API. A reviewer may see a normal pull request, while the agent receives a different machine-consumed context. Automated review agents, scheduled agents, and agents triggered by repository events widen that gap because no person may inspect the exact content passed to the model before action.
Controls need to follow the authority given to agents. Least privilege should apply to agent sessions, not only human accounts. Sensitive projects should not be reachable through broad reviewer tokens where the agent does not need that access. Tool calls should be logged, attributable, and bounded. Pull request descriptions, comments, issues, build logs, and wiki pages should be treated as untrusted input by default.
The Azure DevOps MCP issue is useful because it is ordinary in the way serious enterprise risk often is. The agent follows instructions, uses granted tools, and acts under a legitimate identity. When those elements are combined without strict boundaries, identity governance extends from people and service accounts into the agents now operating between them.
