Published: 2026-08-10
Categories: Agentic AI Security
Key Takeaways
Two independent security research teams have disclosed separate flaws in Atlassian’s Rovo AI assistant that allow attackers to exfiltrate Jira tickets, Confluence pages, and connected third-party data through indirect prompt injection. PromptArmor’s finding, published August 5, 2026, shows that Rovo’s URL-retrieval tool can be manipulated to send a victim’s accessible data to an attacker-controlled server even after an organization has disabled Rovo’s web search feature, because the underlying retrieval capability sits outside that control’s scope [1][2]. A second, related flaw dubbed “RovoBlast,” disclosed separately by Varonis Threat Labs, allowed a single click on a crafted link to preload attacker instructions into Rovo Chat via a URL parameter; Atlassian patched that path server-side on July 8, 2026 [3]. As of this writing, the content-borne injection path PromptArmor reported remains unresolved, and organizations running Rovo across Jira, Confluence, or connected SharePoint, Outlook, and other integrations should treat any Rovo-processed document as a potential exfiltration vector until Atlassian confirms a fix. This case is a clear illustration of a broader pattern CSA has tracked in agentic AI security: prompt injection in enterprise AI assistants is best defended as an architectural exposure — an untrusted-content path that reaches a tool with network egress — rather than a bug that prompting or filtering alone can patch away [4].
Background
Rovo is Atlassian’s AI assistant, woven into Jira, Confluence, and a set of connected applications, and it is enabled by default for customers on Standard, Premium, and Enterprise plans [1]. Rovo operates with the permissions of the user invoking it, searching and summarizing Jira tickets, Confluence pages, and data pulled through connectors to services such as SharePoint and Outlook [1]. That design is exactly what makes Rovo useful for knowledge work, and exactly what makes it a high-value target: an assistant that can read everything a user can read, and that can also reach the open internet through a URL-retrieval tool, sits at the intersection of sensitive data and an uncontrolled egress path.
Security firm PromptArmor disclosed its findings to Atlassian on May 23, 2026. Atlassian acknowledged the report and assigned a case number two days later, but PromptArmor reported multiple follow-up attempts over the following two months without receiving a substantive response, and published its research publicly on August 5, 2026 [2]. Separately, Varonis Threat Labs identified and reported a related but distinct issue — the RovoBlast URL-parameter attack — through Atlassian’s Bugcrowd program; that report received a $6,000 bounty at Bugcrowd’s P2 priority tier [1], and Atlassian shipped a server-side fix on July 8, 2026, which Varonis validated as effective [3]. Neither issue has been assigned a CVE identifier as of August 8, 2026 [1]. The near-simultaneous disclosure of two independent attack paths against the same product, arriving at different points in an unresolved and a resolved state, is itself informative: it suggests Rovo’s exposure to prompt injection is systemic to its architecture rather than confined to a single implementation bug, and that fixing one entry point does not close the underlying weakness.
Security Analysis
The two disclosed attack paths differ in how the malicious instruction reaches Rovo, but converge on the same underlying weakness: an AI agent with broad read access and an unrestricted way to reach the network will exfiltrate data whenever an attacker can get instructions into its context.
PromptArmor’s attack is a content-borne indirect prompt injection. An attacker embeds hidden instructions in a document — a file that a legitimate user might upload or reference when asking Rovo to organize or summarize Jira tickets. When the user submits that ordinary-looking request, Rovo processes the poisoned document alongside the user’s real data, and the injected instructions redirect the agent’s behavior: it searches Jira and Confluence as instructed, then appends the retrieved sensitive data as parameters to an attacker-controlled URL and fetches that URL using its retrieval tool [2]. The attacker never interacts with the victim’s session directly; the data arrives passively in the attacker’s own server logs. Critically, PromptArmor found that disabling Rovo’s organization-level web search setting does not stop this exfiltration, because the URL-retrieval capability Rovo uses to “check” a link is implemented separately from the search feature and is not gated by the same control [1][2]. That gap is a confused-deputy pattern: the control an administrator reasonably believes closes the door in fact governs a different door, while the one the attacker uses stays open.
RovoBlast, as documented by Varonis, is a parameter-injection attack rather than a content-injection one. Atlassian’s Rovo Chat interface accepts a rovoChatPrompt URL parameter that preloads a prompt directly into the chat session; Varonis found that a single click on a crafted link — for example, shared over email, chat, or a webpage — would surface the attacker’s embedded instructions inside Rovo Chat without any warning or confirmation step, executing with the full trust of the clicking user’s authenticated session [3]. Rovo can reach more than 50 connected platforms, including Jira, Confluence, Bitbucket, and third-party connectors [3], and it includes an autonomous “ResearchAgent” capable of multi-step browsing and data retrieval across connected and open-web sources — a capability that, combined with Rovo’s network egress, could chain fetch-and-exfiltrate actions once triggered [3]. Because of that reach, a successful click could set off multi-step data collection and exfiltration without further user interaction. Atlassian’s fix, confirmed in production by July 8, 2026, closed this specific parameter-based delivery mechanism, but it did not address the content-borne path PromptArmor separately reported, underscoring that the two disclosures are complementary views of the same structural issue rather than duplicates of one bug [1][3].
Both attacks share three properties that define the core exposure in this case, and that recur across agentic AI exfiltration risk more broadly. Rovo ingests content it cannot fully trust, whether an uploaded document or parameters embedded in a shared link. It executes tool calls against data the user is authorized to see, which in an enterprise context routinely includes sensitive tickets, credentials referenced in tickets, and internal documentation. And it has access to a network egress path — the URL-retrieval or “fetch” tool — that an attacker can influence to determine where that data goes. Any one of those properties alone is manageable; the coexistence of all three, without an architectural control governing what data can reach an outbound request, is what turns a helpful assistant into a data exfiltration channel. The absence of a CVE for either issue, and the fact that PromptArmor’s path remains open more than two months after disclosure, also raises a dynamic worth watching: this SaaS-embedded AI assistant fell outside conventional CVE triage and enterprise patch-management visibility, leaving customers dependent on the vendor’s internal remediation timeline with limited external signal about current exposure.
Recommendations
Immediate Actions
Security teams operating Atlassian Rovo should inventory which user groups and connected applications have Rovo enabled, and restrict Rovo’s scope — by app, by user group, and by connector — to only what is operationally necessary, rather than leaving the default broad-access configuration in place [1]. Because disabling web search does not close the URL-retrieval exfiltration path, teams should not treat that toggle as a security boundary; instead, monitor for unusual outbound requests originating from Rovo sessions where feasible, and treat any document a user intends to have Rovo process as untrusted input that could carry hidden instructions.
Short-Term Mitigations
Organizations should tighten the underlying Jira and Confluence permissions that govern what Rovo can see, on the assumption that Rovo will eventually process anything a given account can access; least-privilege scoping of the human account limits the ceiling of any successful exfiltration regardless of which tool-level flaw an attacker exploits next. Security teams should also extend phishing-style awareness guidance to cover crafted links containing chat-preload parameters, as seen in RovoBlast, and poisoned documents intended for AI processing, as seen in PromptArmor’s finding, since both rely on getting a legitimate user to take an otherwise ordinary action.
Strategic Considerations
Enterprises evaluating or continuing to operate SaaS-embedded AI assistants like Rovo should push vendors, through procurement and renewal conversations, toward deterministic, auditable policy enforcement on egress that sits outside the model itself, rather than reliance on the model behaving correctly when it encounters untrusted content. Where an assistant’s tool set includes any form of URL fetch, image rendering, or outbound network capability, that capability should be treated as an egress control point requiring destination allowlisting or explicit approval, not as an incidental feature. Longer term, CSA’s research into related metadata-based attack classes suggests that even after content-based injection is addressed, agents that trust unverified identifiers, authorship metadata, or tool-call records without provenance checks remain exposed to adjacent attack techniques, so remediation should be scoped to the broader trust-boundary problem rather than to this specific reported flaw [4].
CSA Resource Alignment
The most directly relevant CSA artifact is Agent Data Injection: A New Attack Class Beyond Prompt Injection, which documents how AI agents extend implicit trust to metadata and inputs beyond the instruction text itself — such as UI identifiers, authorship metadata, and tool-call records [4]. RovoBlast is a close real-world match to that pattern: Rovo treated an externally supplied rovoChatPrompt URL parameter as a trusted chat input, with no validation or user confirmation before executing it, the same class of unverified-metadata trust the CSA research found in browsing and coding agents. That research also found that defenses purpose-built to catch instruction-based prompt injection frequently fail to catch this metadata-level class of attack, reinforcing that Atlassian’s July 2026 fix for the URL-parameter path does not necessarily generalize to other trust gaps in Rovo’s architecture.
For organizations threat-modeling Rovo or comparable AI assistants embedded in SaaS platforms, CSA’s MAESTRO Agentic AI Threat Modeling framework provides a structured, seven-layer approach for locating this class of risk within an agent’s data-operations and tool-execution layers, distinguishing threats inherent to the underlying technology from those specific to agentic behavior [5]. CSA’s AI Controls Matrix (AICM) v1.1 offers auditable control objectives — spanning data protection, access control, and AI-specific security domains — against which enterprises can assess whether a vendor’s AI assistant enforces the kind of deterministic, out-of-model policy controls this incident shows to be missing, including egress-path restrictions and validation of externally supplied inputs before they influence agent behavior [6].
References
[1] The Hacker News. “Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers.” The Hacker News, August 2026.
[2] PromptArmor. “Atlassian Rovo Exfiltrates Data, Bypassing Controls.” PromptArmor, August 5, 2026.
[3] Dolev Taler / Varonis Threat Labs. “RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data.” Varonis, 2026.
[4] Cloud Security Alliance AI Safety Initiative. “Agent Data Injection: A New Attack Class Beyond Prompt Injection.” Cloud Security Alliance, July 2026.
[5] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 6, 2025.
[6] Cloud Security Alliance. “AI Controls Matrix v1.1.” Cloud Security Alliance, 2026.