AIDEFEND in Action AIA-0075 Validated Research Published: Aug 25, 2026

Atlassian Rovo Had Two Independent Prompt-to-Exfiltration Paths

Two disclosures reached the same lesson through different Rovo entry points. RovoBlast put an attacker prompt in the external rovoChatPrompt URL parameter; Atlassian fixed that server-side route on July 8. PromptArmor separately used hidden instructions in an uploaded document to search Jira and Confluence and send results through Rovo's URL-opening capability, even with web search disabled. The paths belong in one comparison, but not one attack chain.

Prompt InjectionData ExfiltrationTool AuthorizationSink EnforcementAI Copilots
6 applicable AIDEFEND defenses
Source: RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data 
Author: Dolev Taler (Varonis Threat Labs)
Original article: Aug 7, 2026

Threat Analysis

  • RovoBlast began with a crafted Atlassian link. An authenticated user opened a URL containing an attacker-controlled rovoChatPrompt value. Rovo treated the parameter as prompt input and started the task without a separate warning or confirmation.
  • The URL prompt expanded into connected-data access. Rovo's ResearchAgent could search sources available through the victim's session and permissions. The injected instructions selected useful content, encoded it into an attacker-controlled URL or image request, and caused Rovo to fetch that destination.
  • Atlassian closed the parameter route. The coordinated Bugcrowd disclosure records a server-side remediation completed on July 8, 2026. This fix applies to RovoBlast, not automatically to every content-ingestion path.
  • PromptArmor entered through an uploaded document instead. In that separate test, hidden text told Rovo to search Jira and Confluence, append results to an attacker URL, and open it. The user had asked Rovo to organize tickets, not to export internal data.
  • Disabling web search did not remove the second sink. PromptArmor reported that Rovo's URL-opening capability still fetched the model-constructed destination. The vulnerable control plane was therefore broader than the web-search setting.
  • The two paths must remain separate. Neither disclosure says an attacker must use rovoChatPrompt before uploading the malicious document. They are alternative entry and execution routes that converge only on the defensive lesson: untrusted content must not inherit connected-data and outbound-network authority.

Applicable AIDEFEND Defenses (6)

AID-H-018.004
Intent-Based Dynamic Capability Scoping
High
At a Rovo dispatcher with verified integration, derive the signed tool-name set from the user's Jira-organizing task and exclude Confluence or other connector tools that the trusted task does not require. This constrains expansion into those tools, but does not restrict fields, tickets or queries inside an allowed Jira operation. The published method requires server-side enforcement; it is not implemented by the web-search toggle.
AID-H-002.002
Inference-Time Prompt & Input Validation
High
Reject an externally supplied prompt-execution parameter at the request boundary, or make it inert display text. This precisely addresses the rovoChatPrompt route, but uploaded documents need separate instruction/data and tool-policy controls.
AID-H-018.003
High-Impact Independent Validation & Approval Gate
High
Opening a link cannot authorize autonomous multi-source research. Before accessing connected systems or contacting an external destination, require a fresh decision bound to the exact prompt, data sources, destination, and intended output.
AID-H-003.010
Deployed AI Software Vulnerability Remediation Lifecycle
High
Verify Atlassian's July 8 server-side fix against the exact rovoChatPrompt auto-execution route and check private integrations for equivalent parameters. Track the uploaded-document disclosure separately; closing one branch is not evidence that the other is remediated.
AID-H-018.005
Value-Level Capability Metadata & Data Flow Sink Enforcement
Medium
Mark Jira, Confluence, and other connected-source values as sensitive, preserve that label through model transformations, and block them from attacker-selected URLs, images, or fetch requests. This is the shared control that breaks exfiltration in both branches, even if retrieval itself is allowed. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.
AID-H-016.001
System Prompt Structure & Instruction/Data Separation
Medium
Place uploaded-document text in an explicitly untrusted namespace that must not supply tool or search instructions. The user's request remains authoritative; hidden prose in a file cannot inherit the user's access to Jira or Confluence. This requires control of the real prompt serializer. Structural separation reduces spoofing; it does not guarantee model obedience or authorize an action. Tool and output authorization must remain independent; stock SaaS capability is not assumed.

What Defenders Should Do Now

  • Regression-test the fixed rovoChatPrompt route in every tenant and integration that can deep-link into Rovo. A URL parameter must not start an authenticated task without a new, visible decision.
  • Treat uploaded files, ticket text, Confluence pages, search results, and connector output as untrusted data. Keep them structurally separate from user and system instructions.
  • Generate tool and data-source scope from the visible user task. Deny requests for unrelated connected sources even when the current user could access them manually.
  • Apply value-aware sink enforcement before URL, image, webhook, or fetch tools. Test encoded, chunked, transformed, and redirected sensitive values.
  • Inventory outbound-capable Rovo tools independently of the web-search switch. Disabling one feature must not leave another generic URL retrieval path unrestricted.
  • Track the two disclosures with separate remediation evidence, owners, regression tests, and closure decisions.

Conclusion

RovoBlast and the uploaded-document attack are valuable together because they expose two different trust failures in one product. One accepted an executable prompt from a link; the other let file content drive search and outbound access.

AIDEFEND  maps the shared breakpoint to AID-H-018.005 at the data-to-network sink, while AID-H-018.004 can exclude unnecessary connector tool names at an integrated dispatcher. AID-H-002.002 closes the URL-parameter ingress and AID-H-016.001 separates uploaded data from instructions. Keeping those controls branch-specific prevents a fix for one route from being mistaken for a fix for both.

Last updated: