A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds.
The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one of its tools returns pull request descriptions without a prompt-injection guardrail the company had already applied to others.
Offensive security firm Manifold Security detailed the confused-deputy bug this week. Microsoft ships the server so AI agents can read and operate Azure DevOps for a user, across pull requests, pipelines, wikis, and work items, all with the user's own permissions. That is the whole problem: content other people wrote can become instructions the agent acts on.
Azure DevOps PR descriptions accept Markdown, which allows HTML comments. In the web UI, an HTML comment (<!-- ... -->) renders as nothing, so a reviewer scrolling the description sees an ordinary change. The REST API returns it verbatim, and the server hands that text straight to the agent.
That split between what the human sees and what the model receives is the delivery mechanism: the attacker never talks to the agent but plants instructions in content they know it will later read.
