Security Flaw in Azure DevOps Allows AI Agent Hijacking via Pull Requests

REDMOND — A critical vulnerability discovered by cybersecurity firm Manifold Security allows attackers to hijack artificial intelligence agents within Microsoft's Azure DevOps platform, potentially exposing sensitive corporate data. The flaw enables malicious actors to embed hidden comments in pull request descriptions that bypass security guardrails, tricking AI reviewers into accessing unauthorized projects.

The issue stems from a defect in the Model Context Protocol (MCP) server used by Azure DevOps. Researchers demonstrated that specific text strings inserted into code review requests can override prompt-injection protections designed to keep AI agents within their designated scope. When an automated reviewer processes a compromised pull request, the injected instructions compel the agent to ignore its safety protocols and execute commands outside its authorized permissions.

Microsoft confirmed the existence of the vulnerability on Tuesday following Manifold Security's disclosure. The company stated that it has deployed patches for affected Azure DevOps environments to neutralize the threat immediately. Microsoft emphasized that no evidence suggests the flaw was exploited in a real-world attack prior to this discovery, though the potential impact remains significant given the platform's widespread use among enterprise developers.

The vulnerability poses a distinct risk because AI agents often operate with elevated privileges necessary for automated code analysis and deployment tasks. If successfully hijacked, these agents could be directed to read source code from unrelated repositories, extract API keys stored in configuration files, or initiate unauthorized changes across an organization's development infrastructure. Unlike traditional software exploits that target human users through phishing emails, this attack vector targets the automation layer itself, exploiting the trust placed in AI systems.

Manifold Security researchers noted that the flaw is particularly insidious because it relies on social engineering tactics adapted for machine consumption rather than direct code execution errors. The hidden comments are designed to appear as standard documentation or metadata within a pull request, making them difficult to detect through routine visual inspection by human reviewers who may not scrutinize every line of text in automated workflows.

Microsoft is currently working with customers to ensure all instances of the patched software have been applied across their networks. The company has also updated its security advisories to include guidance on monitoring for unusual AI agent behavior, such as unexpected access requests or data exfiltration attempts originating from code review processes.

While immediate remediation steps are underway, questions remain regarding how long the vulnerability existed before detection and whether similar flaws exist in other cloud-based development tools utilizing MCP servers. Security experts warn that as organizations increasingly integrate generative AI into their software supply chains, new attack vectors targeting these automated systems will likely emerge with greater frequency.