An Invisible Pull-Request Comment Turns an AI Reviewer Agent into a Spy

Manifold Security has described a “confused deputy” vulnerability in Microsoft's official MCP server for Azure DevOps. The server lets AI agents read and service pull requests, pipelines, wikis and work items on the user's behalf — with the user's own privileges. And therein lies the root of the problem: text written by outsiders can become an instruction the agent carries out.

How the attack works

Pull-request descriptions in Azure DevOps support Markdown, and therefore HTML comments too. In the web interface, a <!-- ... --> construct isn't shown at all — the reviewer sees an ordinary edit. But the REST API returns such text verbatim, and the server passes it to the agent as is. A discrepancy arises between what the human sees and what the model receives.

When a reviewer asks the agent to check a pull request, the hidden text can rewrite the agent's goal. The agent acts with the reviewer's credentials — which means it can reach projects the attacker has no access to. Manifold stresses that escalation here is the norm: reviewers usually hold higher privileges than the author of the request. The attacker gains nothing directly; they merely borrow someone else's access through text the victim never sees.

The safeguard they forgot to apply

The striking part is that Microsoft had already implemented the needed safeguard. Studying the source code, Manifold found the “spotlighting” technique — wrapping untrusted content in delimiters so the model can tell data apart from instructions. It was added in PR #1062 and is applied to wiki pages and build logs through a shared helper, createExternalContentResponse. But the repo_get_pull_request_by_id tool, which returns the request's description, doesn't call this helper — and hands over the text raw. The Hacker News confirmed that, as of July 21, the hole in the current code had not been closed.

In a demonstration on a local v2.7.0 build, a single hidden comment kicked off a chain: the agent triggered a pipeline in another project, read a confidential wiki page unavailable to the attacker, and posted its contents back into a comment on the pull request. Every call was permitted to the agent — the problem, as the researchers write, lies “in the sequence and intent dictated by text the human never saw.” The attack was also reproduced with Copilot CLI and with Claude Code.

Conditions and recommendations

The attack requires: write access to the project, a workflow that feeds text to the agent, a reviewer with broader access, and an agent in auto-approve mode that doesn't prompt for each tool. It's precisely a broad token combined with such a mode that concentrates the risk.

A Microsoft representative thanked Manifold for the disclosure, called the case “a known class of AI risks,” and advised restricting access to projects and “reviewing proposed changes before entrusting them to AI.” The catch is that the malicious payload is invisible in the very interface the human is reviewing. No CVE has been assigned yet, and there is no fixed version.

Experts advise issuing the agent tokens with minimal privileges, restricting it to the project under review, and stripping everything unnecessary from its toolset — launching pipelines, reading wikis, posting comments. After all, a safeguard works only where someone didn't forget to add it, and is only as reliable as its most vulnerable path is covered.

Source: The Hacker News