Invisible PR comment hijacks Azure DevOps AI reviewer’s permissions
A hidden HTML comment in an Azure DevOps pull request can hijack the reviewer’s AI coding assistant, making it act on projects the reviewer can access and silently exfiltrate data. The bug stems from the MCP server bypassing Microsoft’s prompt‑injection guardrail for PR descriptions, exposing source code, secrets and work items. Researchers at Manifold Security published a proof‑of‑concept.