Intel Node

Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

lowadvisory2026-07-22T04:57:52+00:00source excerpt

cloud

Source excerpt · The upstream feed supplied only part of this article.Read the original source →

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds.

Read Original Source