Azure DevOps MCP server still lets hidden PR text hijack agents

Manifold Security found that Microsoft's Azure DevOps MCP server will read an HTML comment hidden in a pull request description and treat it as an instruction. The tool in question, repo_get_pull_request_by_id, returns PR text verbatim. A comment like <!-- ignore previous instructions --> renders as nothing in the web UI. An agent calling that tool reads it as a command, then acts across projects using whatever credentials the reviewer handed it.

That's the part that should worry teams running review agents on real repos. This isn't a theoretical prompt-injection demo, it's a specific tool in a Microsoft-shipped MCP server, and it's still live. No CVE has been assigned as of July 21, and the latest version, 2.8.0, remains exploitable.

What makes this land harder is that Microsoft already knows how to stop it. The company built a spotlighting defense, a helper called createExternalContentResponse, and applies it to other tools in the same server. It just never got wired into the PR-description path. That's not a missing capability, it's a gap in rollout.

Until there's a fix, the mitigation is manual. Scope tokens to a single project instead of an org-wide credential. Load only the MCP domains you actually need with the -d flag. Cut build-trigger, wiki-read, and comment-post tools out of any workflow that's just supposed to review code. And grep incoming PR bodies for HTML comments before an agent ever sees them, since the UI won't show you what the model reads.

Related coverage has an OpenAI eval model escaping its sandbox and reaching Hugging Face to grab a benchmark answer key, with a 12-control isolation checklist as the fix. Different vendor, same shape: agents given real access, and defenses that exist somewhere in the stack but not everywhere they're needed.