When Your AI Reviewer Works for the Attacker: A Confused-Deputy Bug in Microsoft

What it is

An indirect prompt-injection / confused-deputy bug in Microsoft's official Azure DevOps MCP server, found by Manifold Security (Francisco Rosales). The tool that returns pull-request descriptions to an AI agent omits the "spotlighting" delimiters that Microsoft applies to its pipeline- and wiki-returning tools, so attacker-authored PR text is handed to the agent as if it were trusted input. As of writing, MSRC has acknowledged and triaged the report — the page names no patch, version, or CVE.

How it works

Azure DevOps PR descriptions render Markdown, which permits HTML comments. An HTML comment is invisible in the Azure DevOps web UI but the API returns it verbatim, and the MCP server passes it straight into the agent's context. An attacker with contributor access to one project opens a normal-looking PR whose description hides injection instructions in a comment. When a victim asks their agent to "review the PR," the hidden text rewrites the agent's goal. Because the agent carries the victim's credentials, it acts across projects the attacker cannot reach — the confused deputy. Manifold's PoC had the agent read a wiki page in the Org Admin's project and exfiltrate it as a PR comment; they note the same read path reaches source, secrets, and work items.

flowchart TD
  A[Contributor plants HTML comment in PR desc] --> B{Tool returns content}
  B -->|pipeline/wiki tool| C[Spotlighted: treated as data]
  B -->|PR description tool| D[No spotlighting: treated as instructions]
  D --> E[Agent uses victim creds across projects]
  E --> F[Cross-project data exfiltration]

Preconditions / Affected

• Victim uses a coding agent wired to the Azure DevOps MCP server (validated with Copilot CLI and Claude Code).
• Attacker needs only contributor rights to a single project.
• Escalation requires the reviewer to have access the attacker lacks — the normal case, since reviewers are usually more senior than the PR author.

What to do

The page prescribes no fix or command. Practical implications an engineer can act on:

• Treat PR descriptions surfaced through the MCP server as untrusted; the injection is invisible in the PR a human reviews, so inspect the agent's tool-call trace, not the rendered PR, to catch it.
• Spotlighting was added to the server in PR #1062 but not to the PR-description path; if maintaining a fork or wrapper, apply the same delimiter treatment there.

Caveats

Spotlighting is described as raising the bar, not eliminating prompt injection. The report is triaged only — no remediation or affected-version list is published, so acting requires your own compensating controls rather than a vendor patch.