AI review agents in Azure Pipelines can be hijacked by a single PR description. Four real 2026 incidents, a .NET before-and-after, and an audit checklist.
About the Author
Srikanth Adidhala
I’m a full-stack developer at Keyhole Software, where I build end-to-end applications and modernize existing ones using .NET, C#, Azure, and modern JavaScript frameworks. That covers everything from the front end through to API design and the services behind it. A good part of my recent work has also been on the delivery side — Azure DevOps pipeline architecture, build and release automation, and the agent infrastructure that runs them. I work a lot with AI tooling too, both to build applications faster and to automate the repetitive parts of development, and I’ve spent a fair amount of time on what it takes to bring AI agents into a delivery pipeline without giving them more access than the job needs. I like pulling apart how systems actually behave once they’re running in production, and writing up what I learn so other developers don’t have to find it the hard way.

