Atlassian's Rovo AI assistant can be hijacked to leak Jira and Confluence data

Security researchers have disclosed two separate prompt injection vulnerabilities in Atlassian's Rovo AI assistant that let attackers silently exfiltrate sensitive data from Jira, Confluence, and connected third-party tools — without the victim ever realizing their AI assistant had been hijacked.

Attack One: Hidden Instructions in Ordinary Files

Security firm PromptArmor found that attackers can embed invisible commands inside otherwise ordinary files, such as PDFs — using techniques like white text on a white background in a tiny font, invisible to any human reader but fully readable by Rovo's AI. When an employee uploads such a file and asks Rovo to help with a routine task, like organizing Jira tickets, the hidden instructions hijack the assistant instead. Rovo then quietly pulls sensitive information from Jira tickets, Confluence pages, or other connected data, and transmits it to an attacker-controlled server using its own URL retrieval tool.

The exploit sidesteps a safeguard organizations might assume protects them: disabling Rovo's web search feature does not remove its underlying ability to open external URLs, so the exfiltration channel survives even when an admin thinks they've locked it down. PromptArmor privately disclosed the flaw to Atlassian on May 23, 2026, and published details publicly on August 5 after confirming the vector was still unpatched.

Attack Two: A Single Malicious Link

Separately, Varonis Threat Labs identified a second flaw it calls "RovoBlast," exploiting a URL parameter named rovoChatPrompt that lets an attacker pre-fill Rovo's chat window with instructions before a user even opens it. If a logged-in employee clicks a specially crafted link, Rovo treats the embedded text as trusted input inside that user's active session — running with their real permissions. From there, Rovo's built-in ResearchAgent tool, designed for legitimate multi-source research, can be turned against the organization to autonomously pull data from Jira, Confluence, and integrated services including SharePoint, Slack, Google Workspace, and Microsoft 365, then send it to the attacker.

Varonis reported RovoBlast through Atlassian's Bugcrowd bug bounty program, and Atlassian shipped a server-side fix on July 8, 2026 — a much faster turnaround than the still-open PromptArmor vector.

What's Actually at Risk

Both attacks can expose the same category of sensitive corporate data: Jira ticket contents, Confluence page text, private API keys, workspace member lists, internal page and organization IDs, and author email addresses. Because Rovo operates with whatever access the logged-in user has, the blast radius of a successful attack scales directly with how broadly an organization has connected Rovo to its internal systems.

Why This Matters Beyond Atlassian

As reported by The Hacker News, the underlying weakness isn't unique to Rovo — it's structural to any AI assistant that processes untrusted external content (uploaded files, web pages, or crafted URLs) while also holding privileged access to internal systems. Security researchers have flagged this class of vulnerability, known as indirect prompt injection, as one of the hardest problems in deploying enterprise AI agents, since the attack payload never touches the user directly — it's smuggled in through content the AI reads on the user's behalf.

For organizations running Rovo or similar AI assistants connected to sensitive systems, the immediate practical step is applying Atlassian's July patch for RovoBlast and treating the PromptArmor-reported vector as an active, unresolved risk until Atlassian confirms a fix — including auditing what file types and external content Rovo is permitted to process on behalf of employees.