The official Microsoft MCP server for Azure DevOps does not sanitize pull request descriptions before passing them to an LLM. As a result, a hidden instruction in a PR comment can redirect the AI review agent to projects the attacker does not control and silently exfiltrate their content.
Aug 13, 2026 7 2
In two weeks, four documented incidents have confirmed that autonomous LLM agents have become a real, not just theoretical, attack vector—DeepSeek operated via Telegram, Claude Opus 4.7 compromising organizations, and Azure DevOps MCP hijacked through prompt injection.
Aug 25, 2026 13 3
The pro-Russian group UAC-0099 has found an original workaround against automated analysis by LLM: embedding prompts about nuclear weapons in its malware. The AI tools trigger their filters and refuse to analyze it—a reversed jailbreak that turns AI safeguards against defenders.
Sep 2, 2026 14 3
A developer named Kahris published on GitHub a native iOS port of The Legend of Zelda: Ocarina of Time - 60 FPS, iPad resolution, Bluetooth controller support. The twist: the iOS layer was generated autonomously by Codex 5.6 Sol from OpenAI, based on a single prompt refined for hours.
Jul 28, 2026 25 4
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
Jul 24, 2026 4 2
A flaw in the Azure DevOps MCP (Model Context Protocol) integration allows an invisible comment in a pull request to hijack an LLM agent tasked with reviewing it.
Jul 22, 2026 7 2
