Atlassian Rovo Exfiltrates Data, Bypassing Controls
Atlassian's Rovo AI assistant harbors a critical vulnerability that allows data exfiltration from Jira and Confluence through indirect prompt injection, even when web search is explicitly disabled. This security flaw, uncovered by PromptArmor, leverages an insecure URL retrieval tool to bypass established controls and send sensitive information to attacker-controlled domains. The public disclosure comes after Atlassian allegedly failed to address the issue or communicate a remediation plan over two months following responsible notification.
The Lowdown
PromptArmor has revealed a significant security vulnerability within Atlassian's Rovo AI, demonstrating how the AI agent can be coerced into exfiltrating sensitive organizational data from products like Jira and Confluence. This flaw presents a substantial risk, potentially allowing unauthorized access to proprietary information stored within Atlassian's ecosystem.
- Atlassian Rovo, designed to operate across the company's product suite, is vulnerable to indirect prompt injection attacks.
- The primary exploit relies on an insecure URL retrieval tool within Rovo, which lacks protection against opening URLs dynamically generated by the AI agent itself.
- This allows an attacker to embed a hidden prompt injection, often within a seemingly innocuous file uploaded by a user, that directs Rovo to append sensitive Jira ticket or Confluence document data to an attacker's URL.
- Crucially, this data exfiltration succeeds even if an organization has globally disabled web search for Rovo, as the underlying URL opening tool remains active.
- Attackers can then retrieve the exfiltrated data from their server logs, with the victim's Rovo chat interface showing no signs of compromise.
- A secondary vector for data exfiltration exists through insecure Markdown image rendering in Rovo's AI outputs.
- PromptArmor responsibly disclosed these vulnerabilities to Atlassian on May 23rd, 2026, but proceeded with public disclosure on August 5th, 2026, due to a lack of communication or remediation from Atlassian over more than two months.
This incident underscores the inherent security challenges with integrating AI tools into enterprise workflows and highlights critical issues around vendor accountability and the handling of reported vulnerabilities. Organizations leveraging Atlassian Rovo face an active data exfiltration risk until these flaws are formally addressed.