A newly uncovered vulnerability in Microsoft’s Azure DevOps MCP server reveals a method for exploiting AI coding assistants through hidden comments in pull requests. This flaw could potentially turn these agents into tools for data exfiltration without the knowledge of the developers involved.
Discovery of the Vulnerability
Manifold Security researchers identified that the flaw allows attackers with access to a single project to manipulate a victim’s AI agent, enabling unauthorized data access from projects otherwise inaccessible. Azure DevOps MCP server integrates various tools, including pull requests and pipelines, that AI agents can access on behalf of users.
The vulnerability arises because Azure DevOps PR descriptions permit Markdown, which attackers can exploit by embedding hidden HTML comments. These comments are unseen in the web interface but are processed by the API, allowing them to manipulate the agent’s actions without detection.
Implications of the Flaw
In a demonstration, researchers showed how a hidden comment could instruct an agent to approve a pull request, initiate a pipeline in a separate project, extract confidential information, and communicate it back to the attacker. This occurs without the human reviewer’s awareness, as the agent uses the victim’s credentials to perform these actions.
This situation exemplifies a ‘confused deputy’ problem whereby an authorized agent is misled into misusing its privileges. The attack is effective because reviewers generally have more extensive access than contributors, and the attacker leverages this access through invisible instructions.
Defensive Measures and Recommendations
Microsoft had previously implemented a defense mechanism called ‘spotlighting’ to differentiate between data and instructions. However, this safeguard was not applied to pull request descriptions, leaving an exploitable entry point for attackers.
Manifold Security reported the issue to Microsoft, which acknowledged the problem but has not yet assigned a CVE or released a fix. The vulnerability aligns with Simon Willison’s ‘lethal trifecta’ framework, highlighting the risks of AI agents exposed to private data and untrusted input with a data exfiltration channel.
Strategies for Security Teams
Security teams managing MCP-connected agents should take several precautions. These include restricting agent tokens to the minimum necessary privileges, ensuring tools are loaded strictly as needed, excluding non-essential functions from code review tools, and auditing PR descriptions for hidden comments.
Ultimately, the research underscores the importance of continuous visibility in agent-driven automation, as each authorized action can become dangerous through unintended sequences and hidden intents.
