A single, invisible comment slipped into an Azure DevOps pull request is enough to hijack an AI-powered code reviewer, redirecting it into unauthorized projects and quietly exfiltrating sensitive data. The vulnerability lurks in Microsoft’s official Azure DevOps MCP server, where a tool that fetches pull request descriptions lacks basic prompt-injection protections that the company had already implemented elsewhere.

The attack exploits a gap in how the MCP server handles user-supplied text. When an AI review agent processes a pull request, it calls a tool that returns the PR description—including any hidden comments embedded in markdown or invisible Unicode characters. An attacker can craft a comment that injects new instructions into the agent’s system prompt, effectively taking control of the bot. Once hijacked, the agent can be commanded to scan other repositories, open new PRs, or send findings to external endpoints, all under the guise of a legitimate reviewer.

Microsoft has acknowledged the issue and is working on a fix, but the incident underscores a broader challenge for teams deploying AI-assisted code review. As organizations rush to integrate large language models into their DevOps pipelines, they often overlook the fact that these agents operate on the same untrusted input as any other user. The Azure DevOps MCP server is widely used in enterprise environments, and the vulnerability could allow an attacker with minimal access—just the ability to comment on a PR—to turn a trusted automation tool into a backdoor.

Source: The Hackers News