Opening SecureFlowAzure DevOps MCP Review Agent Cross-Project Exfiltration
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Manifold Security aidefend-sf0058

Azure DevOps MCP Review Agent Cross-Project Exfiltration

  • Autonomous Agents
  • Data Exfiltration

Manifold Security showed that an HTML comment hidden in an Azure DevOps PR description was returned verbatim by the official MCP server's PR tool. Claude Code and Copilot CLI agents reviewing the PR followed it to run a pipeline and read a wiki in a project the contributor could not access, then posted the wiki content as a comment on the contributor's PR. MSRC acknowledged and triaged the report; the cited post did not confirm a fix.

Mapped threat techniques

  • AML.T0051.001 LLM Prompt Injection: Indirect
  • AML.T0053 AI Agent Tool Invocation
  • AML.T0086 Exfiltration via AI Agent Tool Invocation

Source

Updated