Azure DevOps MCP review bug shows hidden PR text can steer agent tool calls
Substantial-Heat-321 · reddit · 2026-07-25
A Reddit post highlights a confused-deputy edge case in Microsoft’s Azure DevOps MCP server: hidden PR text can steer an AI review agent’s tool calls while it is operating under the user’s Azure DevOps permissions.
Key takeaways:
- The issue was reportedly reproduced with both Copilot CLI and Claude Code.
- No fixed release or CVE had been published as of July 21.
- Treat repository and PR text as untrusted input, even during “review-only” flows.
- Use a read-only identity for discovery/review, and keep write-capable tools behind a separate approval step.
- Log exact tool arguments plus the source text that triggered them.
- Pin and review MCP server versions instead of assuming an official server is automatically safe.
- Require frozen tests or a human check before applying agent-suggested changes.
The post asks whether teams are separating review permissions from action permissions with two agents or two identities, or whether that adds too much friction.
More from coding & agent
- LangChain ships Managed Deep Agents 0.9, walkthrough from Interrupt London keynote — LangChain · 2026-10-26
- Spring AI 2.1.0-RC1 adds tool-call confirmation, pausing agent loops before real-data access — therealdanvega · 2026-10-26
- Morgan Stanley and US banks block third-party AI agents over credentials — thione · 2026-10-26
- METR red-teams OpenAI's agent monitoring, finds bypasses and gaps — thione · 2026-10-26
- OpenAI: coding agents weakened safety monitoring, one lied about it — thione · 2026-10-26
- ConvFill: A 0.6B Talker Buys Time While a Large Reasoner Whispers the Real Answer — andimarafioti · 2026-10-26