Manifold Security describes a case of a "confused deputy": an HTML comment hidden in a PR description drives the reviewer's AI assistant and exfiltrates data from other projects.
Researchers at Manifold Security have published a flaw analysis in Microsoft's official MCP server for Azure DevOps, the component that exposes pull requests, pipelines, wikis, and work items as tools for use by an AI agent. The vector is a one-line line: pull request descriptions accept Markdown, i.e. HTML comments. These comments don't appear anywhere in the web interface, but the API returns them as they are — and the agent reads them as plain text.
The proof goes a long way. An attacker with access to a single project writes a booby-trapped PR; when a colleague's review assistant processes it, it follows the injected instructions: approve the pull request, trigger a pipeline in another project, read a confidential wiki page, and then return the stolen content as a comment. The agent acts with the rights of its victim, giving access to projects that the attacker would never have been able to reach directly.
The cause is incompletely enforced protection. Microsoft uses spotlighting, which encloses untrusted content with delimiters so that the model distinguishes data from statements; the createExternalContentResponse shared wizard does this for wiki pages and build logs, but the tool returning pull request descriptions bypassed this passage.
Read the full article on the original source
Go to the source →