Validated Research Published: Aug 25, 2026

Atlassian Rovo Had Two Independent Prompt-to-Exfiltration Paths

Two disclosures reached the same lesson through different Rovo entry points. RovoBlast put an attacker prompt in the external rovoChatPrompt URL parameter; Atlassian fixed that server-side route on July 8. PromptArmor separately used hidden instructions in an uploaded document to search Jira and Confluence and send results through Rovo's URL-opening capability, even with web search disabled. The paths belong in one comparison, but not one attack chain.

Prompt InjectionData ExfiltrationTool AuthorizationSink EnforcementAI Copilots
6 applicable AIDEFEND defenses
Source: RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data 
Author: Dolev Taler (Varonis Threat Labs)
Original article: Aug 7, 2026

Threat Analysis

  • RovoBlast began with a crafted Atlassian link. An authenticated user opened a URL containing an attacker-controlled rovoChatPrompt value. Rovo treated the parameter as prompt input and started the task without a separate warning or confirmation.
  • The URL prompt expanded into connected-data access. Rovo's ResearchAgent could search sources available through the victim's session and permissions. The injected instructions selected useful content, encoded it into an attacker-controlled URL or image request, and caused Rovo to fetch that destination.
  • Atlassian closed the parameter route. The coordinated Bugcrowd disclosure records a server-side remediation completed on July 8, 2026. This fix applies to RovoBlast, not automatically to every content-ingestion path.
  • PromptArmor entered through an uploaded document instead. In that separate test, hidden text told Rovo to search Jira and Confluence, append results to an attacker URL, and open it. The user had asked Rovo to organize tickets, not to export internal data.
  • Disabling web search did not remove the second sink. PromptArmor reported that Rovo's URL-opening capability still fetched the model-constructed destination. The vulnerable control plane was therefore broader than the web-search setting.
  • The two paths must remain separate. Neither disclosure says an attacker must use rovoChatPrompt before uploading the malicious document. They are alternative entry and execution routes that converge only on the defensive lesson: untrusted content must not inherit connected-data and outbound-network authority.

Applicable AIDEFEND Defenses (6)

AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Very High
Mark Jira, Confluence, and other connected-source values as sensitive, preserve that label through model transformations, and block them from attacker-selected URLs, images, or fetch requests. This is the shared control that breaks exfiltration in both branches, even if retrieval itself is allowed.
AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
Derive a short-lived set of data sources and tools from the user's visible task. A ticket-organizing request can access selected ticket fields, but URL or document text cannot expand the scope to every connected Jira, Confluence, Slack, or Microsoft 365 source.
AID-H-002.002
Inference-Time Prompt & Input Validation
High
Reject an externally supplied prompt-execution parameter at the request boundary, or make it inert display text. This precisely addresses the rovoChatPrompt route, but uploaded documents need separate instruction/data and tool-policy controls.
AID-H-016.001
System Prompt Structure & Instruction/Data Separation
High
Place uploaded-document text in an explicitly untrusted namespace that cannot supply tool or search instructions. The user's request remains authoritative; hidden prose in a file cannot inherit the user's access to Jira or Confluence.
AID-H-018.003
High-Impact Independent Validation & Approval Gate
High
Opening a link cannot authorize autonomous multi-source research. Before accessing connected systems or contacting an external destination, require a fresh decision bound to the exact prompt, data sources, destination, and intended output.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Verify Atlassian's July 8 server-side fix against the exact rovoChatPrompt auto-execution route and check private integrations for equivalent parameters. Track the uploaded-document disclosure separately; closing one branch is not evidence that the other is remediated.

What Defenders Should Do Now

  • Regression-test the fixed rovoChatPrompt route in every tenant and integration that can deep-link into Rovo. A URL parameter must not start an authenticated task without a new, visible decision.
  • Treat uploaded files, ticket text, Confluence pages, search results, and connector output as untrusted data. Keep them structurally separate from user and system instructions.
  • Generate tool and data-source scope from the visible user task. Deny requests for unrelated connected sources even when the current user could access them manually.
  • Apply value-aware sink enforcement before URL, image, webhook, or fetch tools. Test encoded, chunked, transformed, and redirected sensitive values.
  • Inventory outbound-capable Rovo tools independently of the web-search switch. Disabling one feature must not leave another generic URL retrieval path unrestricted.
  • Track the two disclosures with separate remediation evidence, owners, regression tests, and closure decisions.

Conclusion

RovoBlast and the uploaded-document attack are valuable together because they expose two different trust failures in one product. One accepted an executable prompt from a link; the other let file content drive search and outbound access.

AIDEFEND  maps the shared breakpoint to AID-H-018.005 at the data-to-network sink, while AID-H-018.004 limits connected-source scope. AID-H-002.002 closes the URL-parameter ingress and AID-H-016.001 separates uploaded data from instructions. Keeping those controls branch-specific prevents a fix for one route from being mistaken for a fix for both.