Invisible Pull‑Request Comment Flaw in Azure DevOps MCP Lets AI Review Agents Leak Code
What Happened — Researchers discovered that a single invisible comment embedded in an Azure DevOps pull‑request (PR) can be returned by the Microsoft Azure DevOps MCP server without any prompt‑injection guardrails. The hidden comment can steer the built‑in AI code‑review agent to execute arbitrary queries against repositories the reviewer does not have access to, causing silent data leakage.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses SOC 2 CC6.1 – Change Management and CC6.2 – Risk Management controls that require documented safeguards for automated tooling.
- It creates a blind spot in continuous monitoring: AI‑driven agents can exfiltrate code without generating traditional audit logs, undermining the evidence trail needed for a SOC 2 audit.
- Verisq’s Control Mapping capability can automatically map this newly‑identified control gap to the relevant SOC 2 criteria and collect continuous evidence that the guardrails are in place.
Who Is Affected — Organizations that rely on Azure DevOps for software development, especially SaaS providers, fintech firms, and any enterprise using AI‑assisted code review.
Recommended Actions
- Review and harden Azure DevOps MCP configuration; disable or restrict AI‑review agents until a guardrail is implemented.
- Update internal SOC 2 control inventories to include “AI‑agent prompt‑injection protection” under Change Management and Risk Management.
- Deploy continuous monitoring to capture AI‑agent activity logs and correlate them with access‑control events for audit evidence.
Technical Notes — The vulnerability stems from the MCP server returning PR descriptions without sanitizing hidden comments, enabling prompt‑injection attacks against the AI reviewer. No CVE has been assigned yet; Microsoft has acknowledged the issue and is preparing a patch. Source: The Hacker News