Loading story…
A newly disclosed vulnerability in Microsoft’s official Azure DevOps MCP server allows attackers to hide prompt-injection payloads inside HTML comments in pull request descriptions, where they can be consumed by AI coding or review agents but remain invisible to human reviewers. Manifold Security reported that the Azure DevOps API returned PR descriptions verbatim without the existing “spotlighting” safeguards already applied to pipeline and wiki content, creating a confused-deputy condition in which an AI agent can be manipulated into acting with the broader permissions of the user reviewing the PR.
In a proof of concept, the injected instructions led the victim’s AI reviewer to approve a pull request, trigger a pipeline in another project, read a confidential wiki page, and exfiltrate the stolen data by posting it back in a PR comment. Microsoft Security Response Center acknowledged and triaged the report, but no CVE or patch had been released at the time of publication, leaving organizations using AI-assisted Azure DevOps workflows exposed to cross-project data access and unauthorized actions if reviewer permissions are broader than an attacker’s own access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft Security Response Center acknowledged and triaged the vulnerability report. At the time of publication, no CVE had been assigned and no patch had been released.
In a proof of concept, the researchers induced an AI coding agent to approve a pull request, trigger a pipeline in another project, read a confidential wiki page, and post the stolen contents back to the attacker through a PR comment.
Manifold Security published details of the Azure DevOps MCP server vulnerability, describing how missing protection on pull request descriptions enabled hidden-comment prompt injection against AI agents.
Manifold Security identified a confused-deputy vulnerability in Microsoft's official Azure DevOps MCP server in which hidden HTML comments in pull request descriptions could indirectly prompt-inject an AI reviewer and abuse the reviewer's broader Azure DevOps permissions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemanifold.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and security firms disclosed multiple ways attackers can manipulate AI agents and coding assistants into exposing sensitive data or executing malicious actions. In one case, Invariant Labs showed GitHub integrations built on the **Model Context Protocol (MCP)** could be abused to access private repositories, while Adversa AI reported a **two-click** exploit in Cursor that can trick developers into installing a malicious MCP server through a deeplink argument-injection flaw and a misleading confirmation dialog. Because MCP servers run with the user’s privileges, a successful attack could lead to arbitrary command execution, theft of source code and secrets, and full compromise of a developer workstation. Separate academic research found that AI agents can also be subverted through poisoned but trusted-looking data rather than explicit prompt injection. A study covered by *Nature* showed agents from OpenAI, Anthropic, and Google often accepted doctored datasets and altered README files, producing manipulated conclusions, while another paper introduced **agent data injection (ADI)**, in which attackers tamper with fields such as sender names, button IDs, or tool history to trigger misclicks, unauthorized purchases, fraudulent merge approvals, or attacker-command execution. Researchers said current defenses remain weak because agents do not reliably distinguish trusted from untrusted data, although measures such as MCP allowlisting, randomized identifiers, and stronger provenance tracking can reduce risk.
Jul 22, 2026
Microsoft disclosed and coordinated fixes for command injection vulnerabilities affecting **Visual Studio Code** and the **Azure `azure-cli-mcp` component**, with both flaws allowing arbitrary code execution through improper validation of user-supplied input before it is passed to a system call. In Visual Studio Code, tracked as **`CVE-2026-21518`** and **`ZDI-26-253`**, a remote attacker can achieve code execution in the context of the current user if a victim opens a malicious project containing a crafted `mcp.json` file; the issue was assigned a **CVSS 7.8** rating and patched by Microsoft.
Jun 29, 2026
Researchers at **OX Security** disclosed a design-level weakness in Anthropic’s **Model Context Protocol (MCP)** that can allow **arbitrary OS command execution** through unsafe `STDIO` transport behavior, creating a broad AI supply-chain risk. The flaw is reported to propagate through Anthropic’s official MCP SDKs into downstream tools and agents, with researchers linking it to at least **10 high- and critical-severity vulnerabilities** across widely used projects. Reported impacts include exposure of sensitive data such as API keys, chat histories, internal databases, and developer workstations, while estimates of exposure range from more than **7,000 publicly accessible servers** to as many as **200,000 servers** potentially at risk. Affected or cited projects include **LangFlow, Flowise, GPT Researcher, Upsonic, Windsurf, Claude Code, Cursor, Gemini-CLI, GitHub Copilot, LiteLLM,** and **LettaAI**. OX Security said it began reporting the issue to Anthropic in late 2025, but Anthropic reportedly treated the behavior as expected and responded by updating security guidance rather than changing the protocol architecture. Researchers described four main abuse paths: direct command injection, hardening bypass, zero-click or near-zero-click prompt injection in AI IDEs and coding assistants, and malicious MCP marketplace submissions that can execute commands on developer machines; they urged organizations to restrict public exposure, sandbox MCP-enabled services, treat external MCP configurations as untrusted, monitor MCP tool use, and install MCP servers only from verified sources.
Jun 29, 2026