Atlassian Rovo AI Assistant Prompt Injection — Jira and Confluence Data Exfiltration

Two independent security firms found that Atlassian Rovo — the company's AI assistant for Jira and Confluence — is vulnerable to prompt-injection attacks that can exfiltrate internal data to attacker-controlled servers. One of the two attack paths remains unresolved as of publication.

Overview

Attack Vectors

1. Content-Borne Prompt Injection (PromptArmor)

PromptArmor demonstrated that malicious instructions hidden in uploaded content that Rovo reads can cause the assistant to:

• Collect data from Jira and Confluence
• Send the exfiltrated data to an attacker-controlled server via URL request
• Bypass any separate approval step
• Operate even with the web-search toggle disabled

2. URL Parameter Injection (Varonis Threat Labs)

Varonis Threat Labs found a separate one-click flaw via the rovoChatPrompt URL parameter that:

• Preloads attacker instructions into the Rovo Chat interface
• Requires only one authenticated user click to trigger exfiltration
• Does not require any uploaded content

Fix Status

• Link flaw (Varonis): Fixed server-side by Atlassian on 8 July 2026
• Content-borne path (PromptArmor): Status remains unconfirmed post-publication
• No CVE assigned for either vulnerability at the time of disclosure

Significance

This vulnerability is significant because:

1. Rovo is deeply integrated into Jira and Confluence, which are widely used across enterprise, government, and financial services globally
2. Prompt injection in AI assistants represents a growing attack surface as organisations deploy AI agents with access to internal data
3. Australian and NZ enterprises using Atlassian products (widespread in both countries) should assess their Rovo deployment and review access controls
4. The split fix status (one path fixed, one unconfirmed) creates ambiguity for security teams

Mitigation

1. Review Atlassian Rovo deployment and disable where not strictly needed
2. Monitor for anomalous outbound requests from Atlassian instances
3. Restrict Rovo's data access scope via Atlassian admin controls
4. Review user education on AI assistant prompt injection risks
5. Monitor Atlassian security advisories for the content-borne path fix

Related Pages

• Irregular Firm Behind Ai Hacking Incidents Won T Say If There Were More — AI agent autonomy and containment failures
• Uk Ncsc Statement On Recent Incidents Resulting From Frontier Ai Evaluations — UK NCSC statement on AI model containment breaches