Azure DevOps MCP Flaw Enables Silent Data Theft via AI Coding Assistants Security researchers at Manifold Security uncovered a critical vulnerability in Microsoft’s Azure DevOps MCP server that allows attackers to hijack AI coding assistants and exfiltrate sensitive data from restricted projects. The flaw exploits hidden HTML comments in pull request (PR) descriptions content invisible in the web interface but readable via API to perform indirect prompt injection. When a victim’s AI agent reviews a malicious PR, it unknowingly executes embedded instructions, such as approving the PR, triggering pipelines in unrelated projects (e.g., "Payments"), and extracting confidential wiki pages. The stolen data is then posted as a PR comment, accessible to the attacker. Since the agent operates under the victim’s credentials, it bypasses access controls, enabling attackers to reach data they couldn’t access directly a classic "confused deputy" attack. Microsoft had previously implemented "spotlighting" a defense that wraps untrusted content in delimiters to mitigate such risks. However, the fix was applied to pipeline and wiki tools but not PR descriptions, leaving the attack vector open. Manifold Security reported the issue to Microsoft’s Security Response Center, which acknowledged it, though no CVE has been assigned or patch released as of publication. The incident aligns with Simon Willison’s "lethal trifecta" framework for AI agent risks: access to private data, exposure to untrusted content, and an exfiltration channel. Researchers emphasize that while each agent action appears authorized, the hidden intent and sequence of commands create the threat. The attack highlights the need for continuous monitoring of AI-driven automation, as traditional code audits may miss dynamic, context-aware exploits.