Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data

Cybersecuritynews •Guru Baran • July 22, 2026

A newly disclosed flaw in Microsoft’s official Azure DevOps MCP server shows how an invisible in a pull request can silently hijack a developer’s AI coding assistant and turn it into a data-exfiltration tool. Security researchers at Manifold Security found that the bug lets an attacker with access to just one project steer a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Azure DevOps MCP Server Vulnerability Enables AI Agent Hijacking A critical vulnerability in Microsoft Azure DevOps Model Context Protocol (MCP) server has been identified, allowing attackers to perform indirect prompt injection attacks. By embedding invisible HTML in pull request descriptions, attackers can manipulate AI coding assistants to execute unauthorized actions. This exploitation can lead to accessing confidential wiki pages, triggering pipelines in restricted projects, and exfiltrating sensitive data. The AI agent operates with the reviewer's elevated credentials, amplifying the risk. The vulnerability affects all users of Azure DevOps MCP servers, posing a significant threat to organizations relying on this platform. As of now, no patches have been released to mitigate this vulnerability. Security professionals are advised to monitor for unusual activities related to AI agents and pull requests. 3 sources 67

Extracted Entities

Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Agents and Steal Data

The full story

Extracted Entities

Attack Types (1)

Companies (2)

CWE Weaknesses (1)

Platforms (1)