Why it matters
This demonstrates how a single unsanitized tool response in a widely-deployed, Microsoft-authored MCP server can convert a trusted AI code-review agent into an insider threat capable of lateral movement across projects the human reviewer has no rights to access, entirely through indirect prompt injection with no code exploit required.
Attack vector
Azure DevOps PR descriptions render Markdown, which supports HTML comments invisible in the web UI. Microsoft's official Azure DevOps MCP server returns PR descriptions to an AI agent without the prompt-injection sanitization guardrail applied to other tools, so an attacker can embed invisible instructions in a PR comment that hijack a reviewer's own AI agent into accessing unauthorized cross-project resources and exfiltrating data — a confused-deputy vulnerability.
Affected systems
Microsoft Azure DevOps MCP server
Mitigation
Apply spotlighting/sanitization to all MCP tool outputs including PR descriptions and comments; scope agent tokens to least privilege per-project rather than broad organizational access; monitor agent tool-call traces for unauthorized cross-project actions.