Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

A vulnerability in Microsoft's Azure DevOps MCP server allows an attacker to add a hidden comment to a pull request, which can then manipulate a reviewer's AI coding agent. This can enable the agent to access projects that the attacker would not normally have permission to access. The flaw exploits the lack of a prompt-injection guardrail in one of the server's tools, which returns pull request descriptions without proper protection. As a result, the AI agent can be driven to leak sensitive information from the accessed projects. The attack relies on a single invisible comment in the pull request to initiate the exploitation.