Azure DevOps MCP review bug shows hidden PR text can steer agent tool calls
Substantial-Heat-321 · reddit · 2026-07-25
A Reddit post highlights a confused-deputy edge case in Microsoft’s Azure DevOps MCP server: hidden PR text can steer an AI review agent’s tool calls while it is operating under the user’s Azure DevOps permissions.
Key takeaways:
- The issue was reportedly reproduced with both Copilot CLI and Claude Code.
- No fixed release or CVE had been published as of July 21.
- Treat repository and PR text as untrusted input, even during “review-only” flows.
- Use a read-only identity for discovery/review, and keep write-capable tools behind a separate approval step.
- Log exact tool arguments plus the source text that triggered them.
- Pin and review MCP server versions instead of assuming an official server is automatically safe.
- Require frozen tests or a human check before applying agent-suggested changes.
The post asks whether teams are separating review permissions from action permissions with two agents or two identities, or whether that adds too much friction.
More from coding & agent
- GPT-6 Astra beats Factorio with enemies in 44 in-game hours at ~$4,500 API cost — liminal_bardo · 2026-09-11
- Treating agents like 50 First Dates: a 3-layer context system so every conversation doesn't start from zero — evielync · 2026-09-11
- SmolVM open-sources persistent computer infrastructure for agents that outlive chat sessions — aniketmaurya · 2026-09-11
- ARRM targets silent economic regressions in AI agents that functional tests miss — Beautiful_Belt_601 · 2026-09-11
- Dev builds browser 3D pizza delivery game with Claude: physics, GPS pathfinding, traffic AI — vinishkapoor · 2026-09-11
- Build X Carousel Posts from One Wide Image: A Splitter Tool Plus YouMind Skill Workflow — sujingshen · 2026-09-11