The Intake — Sunday, August 3, 2026

If you're using Claude Code or Copilot CLI to review pull requests in Azure DevOps, a disclosed vulnerability means those agents can be redirected by hidden content in the PR itself.

Manifold Security researcher Francisco Rosales documented the flaw. The affected server is Microsoft's Azure DevOps MCP implementation. An attacker with repository contributor access can embed HTML comments in pull request descriptions. Those comments are invisible in the Azure DevOps web UI. When an AI agent reads the PR via the API, it receives those comments verbatim. The instructions then execute under the developer's credentials. Possible outcomes include reads of confidential wikis and pipeline triggers. Cross-project data exfiltration is also in scope. Microsoft added spotlighting guardrails to the azure-devops-mcp repository. The change appears in PR #1062. That change was not applied to the PR description tool. MSRC acknowledged the disclosure as of July 22. No specific remediation timeline has been committed to.

If your code-review workflow routes Claude Code or Copilot through the Azure DevOps MCP server and pulls PR descriptions, the PR description tool is the unpatched surface.

---

NVIDIA released SkillSpector this week — an open-source static analysis scanner targeting the skill packages that agent frameworks load from community sources.

The scanner is available on GitHub under Apache 2.0. Skill packages — the Markdown files with optional Python scripts that agent frameworks use to extend tool capabilities — are the scanner's target. The tool runs a static analysis pass that checks for dangerous function calls: exec, eval, subprocess. It traces tainted data flows to network endpoints. It applies YARA rules across 64 security categories. Prompt injection and credential theft are among the categories covered. An optional second pass uses an OpenAI-compatible LLM endpoint to reduce false positives. NVIDIA reports 87% precision for that pass. Packages scoring above 50 are flagged as "do not install." NVIDIA's accompanying research found that packages tend to cluster vulnerabilities. A skill package containing one vulnerability is 2.12 times more likely to contain additional ones. The scanner outputs results in SARIF format for integration into CI pipelines.

SkillSpector gives you a static analysis pass you can run before installing skill packages from any source you don't fully control.

---

Nscale announced this week it's acquiring Anyscale — the commercial company behind the open-source Ray distributed Python framework — for a reported $1.65 billion.

Nscale is a London-based AI infrastructure company. It closed a $2 billion Series C in March 2026. The valuation at close was $14.6 billion. Nvidia, Nokia, and Dell are among its backers. Anyscale's approximately 200 employees join Nscale, and the Anyscale brand is retained. Existing Anyscale customers continue on the same platform. That covers LLM training, serving, data curation, inferencing, and reinforcement learning. Deal close is expected year-end 2026, pending regulatory approvals. Nscale says it aims for a fully vertically integrated AI cloud. That stack would combine Nscale's power generation, data centers, and GPU compute with Anyscale's orchestration layer.

Platform continuity through close is confirmed for existing Ray and Anyscale customers. Nscale's stated integration goal — a stack where compute and orchestration share the same vendor — would change who controls that orchestration layer if achieved.

---