Overview
Two independent AI security firms have demonstrated that Atlassian’s Rovo AI assistant — deeply integrated with Jira and Confluence — can be coerced via prompt injection into collecting and exfiltrating sensitive workspace data to attacker-controlled infrastructure. The findings, published in August 2026, highlight a growing class of risk in enterprise agentic AI tools: when an AI assistant has broad data access and acts autonomously on instructions embedded in content, the attack surface extends to every document or link a user exposes it to.
Technical Analysis
PromptArmor — File-Borne Indirect Injection
PromptArmor embedded attacker instructions inside an uploaded document. When a user asked Rovo to organise their Jira tickets, the assistant processed the document, retrieved Jira and Confluence data, appended it to an attacker-supplied URL, and silently opened that URL — forwarding the data to the attacker’s server logs. The victim sees only the suggested ticket updates; no exfiltration indicator is presented.
Critically, PromptArmor confirmed the chain worked even with Rovo’s web-search feature disabled. The root cause is that Rovo has no mechanism to verify whether a URL being opened was one the agent itself constructed, versus one injected by attacker-controlled content. A secondary risk was also noted: Rovo renders Markdown images from model output, creating a potential second exfiltration channel, though a full chain through that route was not demonstrated.
Varonis — RovoBlast URL Parameter Injection
Varonis Threat Labs took a different route, identifying that the rovoChatPrompt URL parameter would preload arbitrary attacker instructions into the Rovo Chat interface. A single click from an authenticated user caused Rovo to execute those instructions under that user’s privileges and forward results to an external server. Varonis named this flaw RovoBlast and disclosed it via Bugcrowd. Atlassian applied a server-side fix on July 8, 2026, which was subsequently validated by the researcher.
Framework Mapping
- AML.T0051 – LLM Prompt Injection: Both attack chains rely on injecting instructions into content the model processes as authoritative.
- AML.T0057 – LLM Data Leakage: The explicit goal and demonstrated outcome in both cases is exfiltration of internal workspace data.
- AML.T0043 – Craft Adversarial Data: The uploaded document and poisoned URL are crafted adversarial inputs designed to manipulate model behaviour.
- LLM01 – Prompt Injection and LLM08 – Excessive Agency: Rovo’s ability to autonomously open URLs and act on embedded instructions without human-in-the-loop approval is the enabler of both chains.
- LLM06 – Sensitive Information Disclosure: Jira tickets and Confluence pages contain project roadmaps, credentials, and internal communications.
Impact Assessment
Any organisation running Atlassian Rovo with Jira or Confluence integrations is potentially exposed. The content-borne path requires only that an authenticated user ask Rovo to process attacker-influenced content — a realistic scenario in collaborative environments. The RovoBlast URL vector required only a single authenticated click, making phishing-based delivery trivial. The absence of a user-facing patch for the file-borne path means exposure is managed by configuration rather than remediation.
Mitigation & Recommendations
- Scope Rovo access tightly — restrict which applications and user groups can invoke Rovo to minimise the content-borne injection surface.
- Confirm the RovoBlast patch — verify your Atlassian Cloud tenancy reflects the July 8, 2026 server-side fix.
- Audit outbound URL activity — review Rovo interaction logs for unexpected external URL requests originating from agent sessions.
- Treat uploaded documents as untrusted inputs — educate users that documents from external parties should not be fed to AI assistants with broad data access.
- Monitor Atlassian security advisories — the PromptArmor finding’s remediation status is unconfirmed; track Bugcrowd and Atlassian’s security bulletin for updates.