Azure DevOps MCP Server Flaw Lets PR Comments Hijack AI Agents

Wed, 22 Jul 2026 12:46:13 +0000

Engineer — Act: If you run Microsoft’s official Azure DevOps MCP server for AI code review, disable or restrict the PR-description tool until Microsoft ships a patched version with prompt-injection guardrails; an attacker with only PR-comment access can pivot the agent into unintended projects and exfiltrate output.
SOC/IR — Plan: No published IOCs, but build detection for anomalous AI agent cross-project access in Azure DevOps audit logs — unusual MCP tool invocations touching repos outside the agent’s expected scope are the behavioral signal to hunt for.
Leader — Plan: This illustrates a systemic gap in AI coding-agent deployments: prompt injection via developer workflow inputs can bypass access controls; use this as a prompt to add MCP/AI-agent integration scope to your existing AI governance policy review this quarter.

Azure-Devops on CuraSec