Azure DevOps MCP Server Vulnerability Enables AI Agent Hijacking

A critical vulnerability in Microsoft Azure DevOps Model Context Protocol (MCP) server has been identified, allowing attackers to perform indirect prompt injection attacks. By embedding invisible HTML in pull request descriptions, attackers can manipulate AI coding assistants to execute unauthorized actions. This exploitation can lead to accessing confidential wiki pages, triggering pipelines in restricted projects, and exfiltrating sensitive data. The AI agent operates with the reviewer's elevated credentials, amplifying the risk. The vulnerability affects all users of Azure DevOps MCP servers, posing a significant threat to organizations relying on this platform. As of now, no patches have been released to mitigate this vulnerability. Security professionals are advised to monitor for unusual activities related to AI agents and pull requests.

Key Points: • A critical vulnerability in Azure DevOps MCP allows AI agent hijacking via hidden comments. • Attackers can exploit this flaw to access sensitive data and trigger unauthorized actions. • No patches are currently available, heightening the urgency for organizations to secure their systems.