Published July 23, 2026.

A flaw in Microsoft's official Azure DevOps MCP server lets an attacker hide instructions in a pull-request description — invisible in the web UI — that hijack a reviewer's AI coding agent through prompt injection. Disclosed by Manifold Security, it has no CVE yet and the current v2.8.0 remains vulnerable; the defense is treating agent-read PR content as untrusted.

What happened. Manifold Security disclosed a prompt-injection flaw in Microsoft's official Azure DevOps MCP server, specifically the repo_get_pull_request_by_id tool. Azure DevOps PR descriptions accept Markdown, which allows HTML comments (<!-- ... -->). In the web UI an HTML comment renders as nothing, so a human reviewer sees an ordinary change — but the REST API returns the comment verbatim, and the MCP server hands that text straight to the AI agent. Other tools in the server pass external content through a "spotlighting" helper (createExternalContentResponse) that delimits untrusted text; this PR-retrieval tool bypasses that protection, so hidden instructions reach the model as if trusted. The result is a split between what the human sees and what the model receives, letting an attacker steer the reviewer's own agent into repositories they should never touch.

Is there a CVE or patch for the Azure DevOps MCP flaw?

No CVE has been assigned as of publication, and there is no fixed release — the latest version, v2.8.0 (released June 24), is still vulnerable. Manifold Security notes the root cause is in the server's code, not the transport, so it cannot be mitigated by swapping how the MCP server is connected.

How the invisible prompt injection works

What to do now.

• Treat PR content read by an AI agent as untrusted input, not as a safe document — the human view and the model's view are not the same.

• Run review agents with least privilege: scope them to the single repository under review, with no ambient access to other projects or credentials.

• Require human confirmation before an agent acts on anything beyond the PR it was asked to review.

• Watch for a fixed Azure DevOps MCP release and apply it when Microsoft ships one; until then, assume repo_get_pull_request_by_id output can carry instructions.

Who's affected. Teams using Microsoft's Azure DevOps MCP server (through v2.8.0) to drive AI code-review or coding agents against pull requests, particularly where external contributors can open PRs.

Our read. This is the AI-agent trust boundary we keep returning to: the model is not compromised, the channel is. An attacker who can put text where an agent will read it can act with the agent's privileges, and a rendered-to-nothing HTML comment is a perfect delivery vehicle. You cannot find this by asking the agent nicely — you find it by having someone try to smuggle instructions past it, which is exactly what supervised adversary simulation is for. Until there is a patch, the durable control is architectural: least-privilege agents and a human gate on consequential actions.

Frequently asked questions

Does the Azure DevOps MCP flaw have a CVE? Not as of publication. It was disclosed by Manifold Security under coordinated disclosure; no CVE ID or fixed version has been published yet.

Which version is affected? The latest release, v2.8.0 (June 24), is vulnerable, as are earlier versions. There is no patched build at publication.

Why can't the human reviewer see the malicious instructions? They are placed inside an HTML comment in the PR description, which renders as nothing in the Azure DevOps web UI but is returned in full by the REST API and passed to the agent.

How do I defend before a patch exists? Scope review agents to least privilege, treat PR text as untrusted, and require human approval before the agent takes any action beyond reading the PR under review.

Reporting by The Hacker News; vulnerability detail per Manifold Security. Sources linked above. Related: our roundup of AI coding-agent sandbox escapes.