You opened the pull request, read the description, skimmed the diff, and told your agent to review it. The page looked clean. It was clean — to you. The version your agent received carried an extra paragraph you were never shown, and that paragraph told it what to do next. The review you approved and the text your agent obeyed were two different documents.

On July 22, 2026, the security firm Manifold Security described a flaw in Microsoft's official Azure DevOps MCP server — the connector that lets a coding agent read pull requests, work items, and build logs using your permissions. MCP, the Model Context Protocol, is the standard way an agent plugs into an outside service; here it plugs into your company's source host. One of its tools, the one that fetches a pull request by ID, returns the PR's description exactly as stored. Including the parts a browser hides.

An HTML comment is invisible to you and loud to the agent

A pull request description is Markdown, and Markdown lets you embed an HTML comment: text wrapped in . Your browser renders it as nothing — a blank space, no trace on the page. The REST API underneath does not render anything. It returns the field byte for byte, comment and all.

So an attacker opens a pull request against a repository you can see, and writes a normal-looking description. Buried in it, inside a comment, is a block of instructions: ignore the review task, list the other repositories this account can reach, read their pipeline variables, and post them to this URL. On the web page, none of that is visible. You read a tidy description and a small diff and think, fine, let the agent take a look.

The agent asks the MCP server for the pull request. The server hands back the raw description. The hidden block arrives as part of what looks like legitimate content, and the agent — which cannot see a rendered web page, only the text — treats it as part of the job. Manifold found the pull-request tool skips a guardrail Microsoft had already built. In an earlier change, pull request #1062, the team wrapped untrusted content from wiki pages and build logs in delimiters — a technique called spotlighting that tells the model "everything inside here is data, not orders." The pull-request description never got that treatment. It comes back naked.

The same pull request, two readers. The human opens it in a browser: the HTML comment renders to nothing, so the page looks clean and the review gets approved. The agent asks the MCP server for the same PR and receives the raw field — comment included — so the hidden block arrives as instructions it carries out with your credentials. The document you approved and the document the agent obeyed are not the same document.

Once the agent is following the planted instructions, the damage is not bounded by what the attacker can reach — it is bounded by what you can reach. The account running the review is yours. It can open repositories the attacker has no access to, read the secrets and pipeline variables attached to them, pull work items, and send any of it wherever the hidden text says. The attacker wrote a comment; your identity did the work.

The gap is between the page and the bytes

The same shape keeps turning up under different disguises, which is what makes it worth naming. Two weeks earlier, a paper on the Model Context Protocol showed the same gap with a different disguise: Unicode "tag" characters — a block of code points from U+E0000 to U+E007F that display as nothing at all — smuggled into a tool's own description. A human approving the tool sees a clean, harmless summary. The model receives the summary plus the invisible payload folded into it. The author measured the gap across three separate MCP server implementations and called it an approval-view fidelity gap: the thing shown to the person approving is not a faithful copy of the thing the model acts on.

The same week, the AI Now Institute's Friendly Fire work pointed the problem at the most trusting task an agent has — reviewing someone else's code. Point an agent at an untrusted third-party repository and ask it to assess the code, and the code assesses you back: the material under review is also the material giving orders.

Put those together and the lesson is uncomfortable for the usual safety answer. The standard advice for agent risk is keep a human in the loop — make a person read and approve before anything consequential happens. But an HTML comment, an invisible Unicode block, and a poisoned review target all attack the same thing: the person is approving a render, and the agent obeys the bytes. When those two disagree by design, a human at the keyboard is not a control. They are a rubber stamp on a document they were not allowed to see.

Decide it at the perimeter, not at the eye

Bromure Agentic Coding does not try to make the render honest. It assumes the thing on your screen might be a forgery and moves the decision somewhere the forgery cannot reach: the boundary between the agent's box and everything outside it. The agent — with its MCP connectors, its review task, its credentials — runs inside a disposable Linux VM on your Mac. Whatever it reads and whatever it decides to do, the moment an action tries to leave that box it meets a boundary that judges the action, not the page a human happened to approve.

Start with the part that hurts most in Manifold's write-up: the hijacked reviewer acts with your credentials and reaches projects the attacker never could. In Bromure, the credentials inside the VM are decoys. Real tokens stay on the host; the box holds a brm_… placeholder where the access token should be, a synthetic set of git and cloud credentials, throwaway ssh keys. When the planted instruction says "enumerate every repository this identity can see and dump their secrets," the identity it is holding is a fake one. The real token is substituted in only at the host proxy, on requests to destinations you have approved — a place the injected text cannot steer.

Then the outbound move itself. "Post them to this URL" is a network request to somewhere new, and every network request the agent makes crosses the host proxy on its way out. There, Guardrails can strip destructive or exfiltrating calls outright, and per-destination consent can hold a first-time destination for an explicit human tap — a tap on the real destination and the real payload, resolved from the bytes, not a summary the agent wrote about itself. The approval you give here is not "does this PR look fine." It is "this process wants to send this data to this host." That question cannot be forged by an invisible comment, because it is asked about what actually happened, not about what you were shown.

Two places to make the security decision. On your machine (left), the agent holds your real credentials and the check is a human approving a rendered page — so an invisible comment splits what you approve from what runs, and the reach is everything your identity can touch. In a Bromure VM (right), the credentials are decoys, the disposable box resets, and the decision moves to the host boundary, which gates the real outbound action and its real destination regardless of what the review page showed.

A detection layer sits in front of all this, and it holds up here for a specific reason. Bromure scores the untrusted content an agent reads — a fetched page, a tool response, an instruction file — with an on-device injection detector before the agent acts on it. The reason a hidden comment or an invisible Unicode block fools a person is that a person reads the render. The classifier does not; it reads the same raw stream the model reads. The fidelity gap that makes the attack work against a human eye is not there for a scorer reading the bytes. It is not a wall — a novel enough disguise can still slip a single detector — which is exactly why it sits in front of the containment rather than instead of it.

If the agent gets hijacked anyway, nothing it did survives the session. The box resets to a clean base image, so a planted config, a persistence hook, or a poisoned local file is gone. And every outbound request it made is in the session trace as a logged line — carrying, if the injection tried to exfiltrate, a decoy credential to a destination that was gated on the way out.

What this draws a line around

Containment changes what an injection can accomplish; it is not a patch for Microsoft's server, and it is worth being precise about the edges.

Bromure contains the blast radius; it doesn't fix the tool

The Azure DevOps server still returns the raw description, and the agent still reads the hidden comment. What changes is what follows: the credentials are decoys, the exfil crosses a boundary, the box resets. The upstream fix — spotlight the pull-request field like the wiki and build-log fields — is Microsoft's to ship, and it should.

Substitution covers the secrets you configure

The decoy swap protects the credentials you put in a profile: model keys, git and cloud tokens, managed database endpoints, ssh keys. A token a script writes to a file mid-session, or a secret you paste into the box by hand, is just a file the agent can read. Keep secrets in the broker, not in the workspace.

Detection is a net, not a wall

Reading the bytes instead of the render defeats the invisible-comment and invisible-Unicode tricks, but a determined author can still craft content that reads clean and acts dirty. Treat the scorer as one layer; the disposable box with decoy keys and a gated, logged egress is what holds when it misses.

An approved read is still a read

If the hijacked agent only touches a destination you already trust — the same repository it was reviewing — and reads what your identity may legally read there, that is inside the line the boundary draws. Isolation narrows the reach to what you approved; it does not un-grant a permission you gave.

The recurring mistake is to treat "a human approved it" as the end of the security argument. Three separate pieces of July's research — a raw PR field, an invisible Unicode block, a poisoned review target — say the same thing: the human is approving a picture, and the agent is acting on the source. Stop resting the decision on what a person was shown. Rest it on what actually leaves the box: run the agent where its credentials are fake, its every step outward is judged on the real bytes, and a reset is one command away. Install it.