#azure-devops
-
An Invisible Pull-Request Comment Turns an AI Reviewer Agent into a Spy
A single hidden HTML comment in Azure DevOps can redirect a developer's AI agent into other people's projects and quietly siphon out their data. The cause: a forgotten safeguard in Microsoft's official MCP server.