Hidden PR Prompts Trick Azure DevOps AI Agents

How the attack worked

Researchers demonstrated a proof of concept in which an attacker with access to a single Azure DevOps project embedded hidden instructions inside an HTML comment within a pull request description. The comment was invisible to human reviewers in the Azure DevOps interface, but it was still returned by the API and passed directly to an AI coding agent when it was asked to review the pull request. Following those hidden instructions, the agent retrieved pipeline and wiki content from a separate project and posted the retrieved information back into the attacker-controlled pull request.

Why it succeeded

The core issue is that the AI agent performs actions using the authenticated reviewer's own permissions. Because the agent operates with legitimate credentials, it can carry out actions across projects that the reviewer is authorized to access, even though the attacker has no direct access to that data. Since every action was performed using the reviewer's legitimate permissions, the activity appeared to be authorized rather than malicious, which makes this kind of manipulation hard to catch through normal access controls.

Microsoft's mitigation approach, described as "spotlighting," was applied inconsistently across tools. Pipeline and wiki tools used the mitigation, but the pull request description tool did not, leaving a gap that allowed the hidden instructions to slip through unfiltered.

What to watch for

• Pull requests containing content that isn't visible in the UI but is still processed by tooling, such as hidden HTML comments.
• AI review output that includes unrelated content, like wiki text or pipeline details, that wasn't needed for a code review.
• An AI agent performing cross-project access or data retrieval during what should be a routine pull request review.

The risk grows when an AI agent has access to sensitive enterprise data, is exposed to attacker-controlled content, and has the ability to send data outward, a combination sometimes called the

How do attackers hide prompt injection in a pull request?

Attackers embed instructions inside an HTML comment within a pull request description. The comment stays invisible to human reviewers in the Azure DevOps interface but is still returned by the API and passed to the AI agent during code review.

Why could the AI agent access data from another project?

The AI agent operates using the authenticated reviewer's own permissions, so it can perform legitimate-looking actions across any project the reviewer is authorized to access, even though the attacker themselves has no such access.

What is the 'lethal trifecta' mentioned in this attack?

It refers to three conditions that increase risk: an AI agent having access to sensitive enterprise data, exposure to attacker-controlled content, and the ability to send data outward.

What can organizations do to reduce this risk?

Treat DevOps content like pull request descriptions as untrusted, limit AI agent permissions to least privilege, require human approval for sensitive actions, and monitor AI agent activity for unusual cross-project behavior.