Affected Systems

Microsoft Azure DevOps MCP server versions up to and including v2.8.0 (released June 24, 2026). The flaw affects the repo_get_pull_request_by_id tool, which returns pull request descriptions without prompt-injection guardrails. Both local PAT-based and potentially hosted remote MCP servers are affected. Impacts organizations using AI agents (e.g., Copilot CLI, Claude Code) to review Azure DevOps pull requests.

Exploitation Status

Proof of concept demonstrated by Manifold Security on v2.7.0. No evidence of active exploitation in the wild as of July 21, 2026. The attack requires specific prerequisites: attacker write access to a project, a reviewer with elevated permissions using an AI agent configured for auto-approve mode, and the agent reading pull request descriptions.

Business Impact

Attackers with write access to an Azure DevOps project can embed invisible HTML comments in pull request descriptions that hijack AI review agents. When a reviewer with elevated permissions uses an AI agent to review the PR, the hidden payload can redirect the agent to access projects, source code, secrets, work items, and wikis the attacker cannot reach directly, then exfiltrate data back through PR comments. The attack leverages the reviewer's credentials and is invisible in the Azure DevOps web UI. Risk is highest in organizations using automated AI-driven review workflows with auto-approve postures, where no human validates each agent action. No CVE assigned; Microsoft acknowledges this as a known AI risk class but has not committed to a code fix or patch timeline as of July 21, 2026.

Urgency

🟡 Within a week

Recommended Actions

  • Audit Azure DevOps projects to identify teams using AI agents (Copilot CLI, Claude Code, etc.) for pull request reviews and disable auto-approve mode for MCP tool execution.
  • Restrict write access to Azure DevOps projects to trusted contributors only; review and tighten project permissions to limit who can open pull requests.
  • Implement manual review checkpoints before AI agents execute cross-project actions such as pipeline triggers or wiki reads; configure agents to prompt per-tool approval.
  • Monitor Azure DevOps audit logs for unusual cross-project API calls, pipeline executions, or wiki access patterns initiated by service accounts or PATs associated with AI agents.
  • If using Microsoft Azure DevOps MCP server v2.7.0 or v2.8.0, contact Microsoft support for guidance and watch for updates to the repo_get_pull_request_by_id tool that apply spotlighting or similar prompt-injection defenses.