Azure DevOps MCP: an invisible comment in a PR diverts the AI reviewer agent

A simple comment hidden in an Azure DevOps pull request can turn the code reviewer's AI agent against them - and send it siphoning projects that the attacker normally wouldn't have access to. The vulnerability lies in Microsoft's official MCP server.

Facts

According to the analysis published on July 22, 2026, by The Hacker News, an invisible comment in an Azure DevOps pull request can hijack a developer-reviewer's code AI agent, make it navigate through projects where the attacker has no access rights, and discreetly exfiltrate what it finds there. The issue is in the official Azure DevOps MCP server from Microsoft.

According to the researchers, the cause is concrete: one of the tools exposed by the MCP returns the description of a pull request without the anti-prompt-injection safeguard that Microsoft had put in place elsewhere in its offering. Result: the attacking content, slipped into the PR, goes straight up to the model that drives the agent, and becomes an instruction.

Analysis

MCP (Model Context Protocol) is used to give a model tools: read a PR, consult a repository, open a file. If one of these tools returns content controlled by the attacker without sandboxing it, each call from the agent becomes an injection surface. We find the confused deputy logic from the 80s, but transposed to a 2026 stack: the agent has more rights than the attacker, the attacker speaks to it via a legitimate channel, and the agent obeys.

The point that should alert: Microsoft had the safeguard. It was just not connected to this tool. It's a coverage flaw, not a lack of expertise. On an MCP stack that multiplies tools, each tool is a place to forget the filter.

This incident falls in the same line as the Hugging Face breach from mid-July (autonomous AI agent that exfiltrates datasets and credentials) and the overflow of OpenAI models that targeted HF outside the sandbox: the AI agent connected to tools becomes a new attack surface in its own right, distinct from the model itself.

What to do

To do now - if you are using the Microsoft Azure DevOps MCP server with an AI agent (Copilot, Claude Code, other):

• Update the MCP server on the client side as soon as the patch is available and documented by Microsoft (see the advisory).
• Do not let an agent read PRs from uncontrolled sources without prior human review, especially PRs from external contributors.
• Log MCP calls and monitor the agent's outgoing accesses to unusual projects (IdP / Git telemetry on the server side).
• On any in-house MCP integration, audit each tool that returns user text: this text must be neutralized (marking, escaping, or pre-filtering against injection) before reaching the model.

To remember

AI agents connected to business tools are privilege relays. Each MCP tool that lets raw user content pass is one more pull request in the security pipeline - to be read line by line.