Atlassian Rovo is the AI assistant wired into Jira, Confluence and connected services like SharePoint. In August 2026 two unrelated security firms published two unrelated ways to make it hand data to an attacker.
Neither requires a vulnerability in the usual sense. Both work by giving the assistant instructions it treats as legitimate.
Route one: RovoBlast (Varonis)
Rovo Chat accepts a URL parameter, rovoChatPrompt, that pre-fills the chat box with a prompt.
That is a convenience feature. It is also a way to put attacker text into an authenticated user's assistant with one click.
Varonis showed that a single click from a signed-in user was enough for the assistant to locate information the victim could access, put it into the path of an attacker-controlled image URL, and fetch the image — delivering the data to the attacker's server.
The image-fetch trick is the important half. There is no "send this data" step for a user to approve. The assistant renders an image, the way assistants do, and the request carrying the data is the render.
| Reported to | Atlassian, via Bugcrowd |
| Fixed | 8 July 2026, server-side |
| Bounty | $6,000 |
That one is closed.
Route two: poisoned documents (PromptArmor)
PromptArmor put instructions inside ordinary-looking files — a PDF with white text on a white background in a tiny font. Invisible to a human reader. Fully legible to Rovo.
Ask Rovo to summarise the file and it gathers internal data and sends it out through a URL request, with no separate approval step.
The timeline is the story here:
| Date | Event |
|---|---|
| 23 May 2026 | Privately disclosed to Atlassian |
| 4 June 2026 | PromptArmor follows up |
| — | No further communication |
| 5 August 2026 | Published, described as still active |
Status after publication is unconfirmed.
What actually gets out
Both techniques operate inside the signed-in user's permissions. The assistant cannot reach anything the user could not already open.
That bound is real and it is smaller comfort than it sounds. A mid-level employee at most companies can reach confidential Jira tickets, internal Confluence pages, API keys pasted into a ticket, project plans, customer records and incident-response documentation. Demonstrated targets in the research included private API keys, Jira tickets and Confluence pages.
The permission model was never the control being defeated. The control being defeated is "data does not leave without someone approving it."
One further detail worth knowing if you administer this: the attack works even when organisation-wide web search is disabled, because turning off web search does not remove the underlying URL retrieval tool.
Why these two are the same problem
Varonis attacked the input channel — the URL that seeds the conversation. PromptArmor attacked the content channel — the document the user asks about. One is patched. The other is not, and the reason is structural: you can validate a URL parameter, but you cannot validate a PDF for "contains instructions", because a document that contains instructions is what a document is.
This is the pattern the Five Eyes agencies described in their joint guidance on prompt injection in agentic AI, and it is the same shape as code that runs before a developer types their first prompt. The assistant has no way to distinguish "content the user wants processed" from "instructions the content wants followed", because at the token level there is no difference.
What an Atlassian admin can do this week
- Restrict which apps and user groups have Rovo enabled. This is Atlassian's own mitigation and it is the only lever that reliably reduces exposure right now.
- Do not rely on disabling web search. URL retrieval survives it.
- Treat uploaded documents from outside as untrusted input to the assistant, not merely as files. A supplier's PDF is a prompt.
- Log outbound fetches from the assistant if your tenancy exposes them. Exfiltration through an image URL is invisible in the chat transcript and obvious in egress.
- Assume the content route is live. PromptArmor published because it was unfixed after ten weeks. Nothing since has confirmed a fix.
The uncomfortable summary: the patched bug took eleven weeks and cost $6,000. The unpatched one is the harder of the two, and it is the one that does not need the victim to click anything unusual.
