A single invisible HTML comment in an Azure DevOps pull request can hijack a reviewer's AI coding agent, exploiting a flaw in Microsoft's official Azure DevOps MCP server. The bug, detailed by Manifold Security, works because the server's tool `repo_get_pull_request_by_id` returns pull request descriptions without a prompt-injection guardrail applied to other tools. Azure DevOps PR descriptions accept Markdown, allowing HTML comments (`<!-- ... -->`) that render invisibly in the web UI but are returned verbatim by the REST API to the agent. When a reviewer asks their agent to review the PR, the hidden text can rewrite the agent's goal, and because the agent carries the reviewer's credentials, it can act across projects the attacker has no rights to reach, accessing source code, secrets, and work items. Microsoft had already shipped a defense called spotlighting, added in PR #1062, which wraps untrusted content in delimiters via a shared helper `createExternalContentResponse`, but the pull request tool never calls it. The Hacker News confirmed the same path remains uncovered in the current source as of July 21. Manifold's proof of concept, run on a local build of v2.7.0, showed a contributor opening a normal-looking PR whose hidden comment triggers a pipeline in a different project and reads a confidential wiki page.