Hidden Comments in Azure DevOps Can Hijack AI Review Agents
Microsoft's MCP server flaw allows malicious comments to manipulate AI review agents through invisible HTML injections.
1Invisible Threat: Hidden Comments
A single HTML comment in an Azure DevOps pull request can manipulate AI review agents. Normally invisible, these comments are delivered directly to agents via REST API, enabling execution of malicious commands. Leaving no trace in the user interface, this method makes vulnerability detection significantly harder.
2Privilege Escalation Risk
Attackers can hijack reviewers' permissions to access projects beyond their rights. Using the agent's inherited credentials, they reach source code, secrets, and work items. This becomes particularly critical when targeting senior reviewers with broader access privileges within the organization.
3Microsoft's Missing Safeguard
The 'spotlighting' security measure Microsoft implemented in other tools is absent for pull request descriptions. This technique wraps untrusted content in delimiters, helping AI models distinguish instructions from data. The repo_get_pull_request_by_id tool lacks this protection, creating an ideal attack surface.
4Validated Attack Scenario
Manifold Security demonstrated a proof-of-concept on local v2.7.0 installation. A seemingly normal PR with hidden comments triggered the AI agent to execute pipelines in another project and exfiltrate confidential wiki pages. All actions occurred within the agent's normal permissions without requiring additional approvals.
5Automated Review Risks
While the attack works on human-initiated reviews, automated triage and summarization systems pose greater risks. Trigger-based systems can execute hidden comments without human intervention, potentially allowing leaks to go undetected for extended periods. This exponentially increases the vulnerability's potential impact.
6Industry-Wide Similar Vulnerabilities
This attack vector isn't new. A similar exploit against GitHub's MCP server was demonstrated in May 2025. Simon Willison's 'lethal trifecta' model describes the combination: access to private data, exposure to untrusted content, and data exfiltration channels. Most useful AI agents inherently possess all three characteristics.
7Microsoft's Response and Key Takeaways
Microsoft thanked Manifold for coordinated disclosure while acknowledging this as 'a known class of AI risk.' The company emphasized the attack requires two-user interaction. However, payloads invisible during human review render traditional safeguards ineffective. Security experts reiterate the critical importance of data-instruction separation in AI integrations.
Original article: The Hacker News — Azure DevOps'te Gizli Yorumlarla AI Ajanlarının Ele Geçirilmesi