Audit your MCP servers for tools that skip spotlighting — one missing delimiter in Azure DevOps turned code-review agents into data exfiltrators
Manifold Security disclosed (July 21) a confused-deputy bug in Microsoft's official Azure DevOps MCP server: the tools returning pipeline and wiki content wrap untrusted text in spotlighting delimiters, but the tool returning pull request descriptions does not. An attacker hides instructions in an HTML comment that renders as nothing in the web UI, and a reviewing agent follows them — approving the PR, triggering pipelines in unrelated projects, and posting stolen wiki content back as a comment. The transferable skill is the audit itself: grep every MCP server you trust for tools whose return path lacks the delimiter treatment its siblings have, and scope code-review agent tokens to the single project under review with pipeline-execution and wiki-read tools removed from the toolset.
↳ Follow the thread