Azure DevOps Prompt Injection Targets AI Coding Agents 

Researchers have disclosed a prompt injection vulnerability affecting Microsoft’s official Azure DevOps Model Context Protocol (MCP) server that can manipulate AI coding agents into accessing sensitive information using a developer’s own permissions. 

The findings demonstrate how hidden instructions embedded in a pull request can cause trusted AI assistants to perform unintended actions without the reviewer’s knowledge. 

Key takeaways of the Azure DevOps prompt injection

• Hidden prompt injections in Azure DevOps pull requests can manipulate AI coding agents into performing unauthorized actions using a developer’s legitimate permissions.
• The attack exploits trust between users and AI assistants rather than software vulnerabilities or stolen credentials.
• Researchers found inconsistent implementation of Microsoft’s prompt injection mitigation, leaving pull request descriptions vulnerable.
• AI agents with access to enterprise data, untrusted content, and external communication channels create new attack paths for prompt injection.
• Organizations should combine least-privilege access, AI governance, activity monitoring, and incident response testing to reduce AI agent security risks.

How the Azure DevOps MCP vulnerability works

Microsoft’s Azure DevOps MCP server allows AI coding assistants to interact directly with Azure DevOps resources, including pull requests, pipelines, wikis, work items, and source repositories. 

Because the AI agent operates using the authenticated user’s permissions, it can perform legitimate actions across projects that the user is authorized to access.

Researchers found that attackers with access to a single Azure DevOps project can embed hidden instructions inside an HTML comment within a pull request description. 

Although the comment remains invisible to human reviewers in the Azure DevOps interface, it is returned by the API and passed directly to the AI agent during code review.

When a developer asks the AI assistant to review the pull request, the hidden prompt overrides the agent’s intended task and instructs it to perform additional actions using the reviewer’s credentials.

Microsoft acknowledged and triaged the issue following responsible disclosure.

How prompt injection enables cross-project access in Azure DevOps 

According to the researchers, the attack does not rely on compromising user credentials or exploiting Azure DevOps permissions directly.

Instead, it abuses the trust relationship between the developer and the AI assistant.

In the demonstrated proof of concept, an attacker created a seemingly legitimate pull request containing hidden instructions. 

After the reviewer initiated an AI-assisted review, the agent:

• Read the hidden prompt injection.
• Accessed a pipeline in another project unavailable to the attacker.
• Retrieved confidential wiki content from that project.
• Posted the retrieved information back to the attacker’s pull request.

Because every action was performed using the reviewer’s legitimate permissions, the activity appeared to be authorized.

The researchers describe this as a classic “confused deputy” scenario in which a trusted system is manipulated into misusing its own privileges on behalf of an attacker.

How Microsoft addressed Azure DevOps prompt injection protections 

The research also found Microsoft had already implemented a mitigation called spotlighting, which marks untrusted content so AI models can better distinguish data from executable instructions.

However, the protection was not applied consistently across the Azure DevOps MCP server. 

While tools that return pipeline and wiki content used spotlighting, the tool responsible for returning pull request descriptions did not, leaving the injection path exposed.

The researchers noted that spotlighting raises the difficulty of prompt injection attacks but does not eliminate the risk entirely.

Why AI agent security extends beyond software vulnerabilities 

The findings illustrate a growing challenge for organizations deploying autonomous AI agents. 

As AI systems become responsible for reviewing code, summarizing projects, triggering workflows, and accessing enterprise resources, attackers are targeting the decision-making process rather than the underlying software.

In environments where pull request reviews or other development tasks are initiated automatically, hidden prompt injections may execute without any human interaction, expanding the potential attack surface.

The findings also highlight what researchers describe as the lethal trifecta for AI agents:

• Access to sensitive enterprise data through user credentials.
• Exposure to attacker-controlled content.
• The ability to send retrieved information to external destinations.

Individually, each capability supports legitimate AI automation. Combined, they create opportunities for prompt injection attacks that can redirect trusted agents to perform unauthorized actions.

How organizations can reduce AI agent security risks 

As organizations integrate AI agents into software development workflows, security teams should adopt controls that address both prompt injection and excessive agent permissions. 

• Apply least-privilege access and regularly review AI agent permissions.
• Treat pull requests, comments, issues, and other user-generated content as untrusted input.
• Require human approval for sensitive AI agent actions, including cross-project access and data retrieval.
• Monitor and audit AI agent activity for unusual tool usage, cross-project behavior, and data access.
• Keep MCP servers, AI development tools, and supporting integrations updated with the latest security patches.
• Implement AI governance policies that define approved workflows and restrict high-risk automation.
• Test incident response plans with AI agent compromise and prompt injection scenarios to validate detection and response capabilities.

Collectively, these measures can help organizations reduce their overall exposure.

Bottom line: Azure DevOps prompt injection highlights AI agent risks 

As AI agents become increasingly capable of reading, deciding, and acting on behalf of users, organizations will need visibility into agent behavior alongside traditional endpoint and network monitoring to detect emerging AI-driven attack techniques.

To address these evolving risks, organizations should complement AI governance with a Zero Trust strategy that continuously validates users, devices, workloads, and AI agents before granting access to sensitive resources.