Atlassian Rovo Prompt Injection Flaw: 74 Days Unpatched, Enterprise Data at Risk

TL;DR

If your team uses Atlassian Rovo AI, there is a prompt injection vulnerability that lets attackers silently exfiltrate Jira tickets, Confluence documents, and connected SaaS data. Two independent security firms confirmed the flaw. One attack path was fixed. The other has been open for 74 days with no patch and no CVE.

What Happened

Two separate research teams, Varonis and PromptArmor, independently discovered that Atlassian's Rovo AI assistant can be tricked into sending sensitive enterprise data to attacker-controlled servers. Both firms disclosed their findings publicly in early August 2026.

Varonis found "RovoBlast," a URL-parameter injection technique where a single malicious link could hijack Rovo's chat interface and instruct its built-in ResearchAgent to navigate to external sites and exfiltrate data. Atlassian fixed this server-side on July 8, 2026, and paid a $6,000 Bugcrowd bounty.

PromptArmor found a separate indirect prompt injection path that remains unresolved. An attacker plants hidden instructions inside a document, such as a vendor PDF uploaded to Confluence or a shared backlog guide. When Rovo's ResearchAgent later processes that document, the hidden instructions trigger data collection across the entire Atlassian tenant, Jira tickets, Confluence pages, Bitbucket repos, and any SaaS tools connected via Rovo Connectors, and sends it to an attacker's server.

The PromptArmor vector works even when Rovo's web search feature is disabled, because the attack uses Rovo's own document retrieval tool rather than external web search.

The Timeline

PromptArmor privately disclosed the vulnerability to Atlassian on May 23, 2026. As of August 5, 2026, 74 days later and after multiple follow-ups, Atlassian had not deployed a fix, assigned a CVE, or issued guidance to customers. The disclosure went public because PromptArmor concluded that users needed to know about the risk.

Atlassian has since acknowledged the issue. As of writing, the indirect prompt injection vector remains open.

Two Attack Vectors at a Glance

Both vectors exploit the same design weakness: Rovo's ResearchAgent operates with the full data access permissions of the signed-in user. When an attacker can inject a prompt, they inherit those permissions. The agent can read any Jira ticket, Confluence page, or connected SaaS record the user can access, and send it anywhere.

Why This Matters for Developers

This is not a theoretical attack. It is a practical vector that requires only one step: getting a malicious document into a system Rovo indexes. In an enterprise environment, that could be a vendor invoice PDF, a shared requirements doc from a partner, or a public Confluence page edited by a contractor. No phishing. No malware. Just a PDF.

The attack exploits a trust assumption baked into every AI assistant connected to internal data: that the documents it reads are benign. Rovo, like Copilot for Microsoft 365, Glean, and other enterprise AI search tools, is designed to pull data from everywhere and synthesize answers. That architecture maximizes utility. It also maximizes blast radius.

Companies are racing to connect AI to internal knowledge bases. Atlassian alone claims Rovo connects to over 50 third-party SaaS tools through its connector marketplace. Each connection is a potential exfiltration path.

What You Can Do

If your organization uses Atlassian Rovo, there is no patch to apply yet, but you can reduce risk:

First, audit which data sources Rovo indexes. If Rovo has access to Jira projects, Confluence spaces, or connected SaaS tools that contain sensitive data, consider narrowing that scope.

Second, restrict who can upload documents to spaces Rovo indexes. The PromptArmor vector requires a document to reach Rovo's processing pipeline. Limiting upload permissions on Confluence and Jira reduces the attack surface.

Third, monitor Rovo's activity. Watch for unusual ResearchAgent queries or outbound connections to unfamiliar domains. If Rovo logs are available, review them.

Finally, push your Atlassian admin to ask about the status of a fix. PromptArmor's public disclosure on August 5 means the attack method is now described in detail online. The window between public disclosure and patch deployment is when these vulnerabilities get exploited in the wild.

The Bigger Picture

I have been tracking AI agent security incidents for months, and the pattern is hard to miss. Agents get connected to more data sources. They get more autonomy. Then someone finds a way to make them do things nobody intended. We saw it with OpenClaw hijacking a gym booking system. We saw it with CoreBreak bypassing agent harness sandboxes. We saw it with Black Hat 2026 revealing CI pipeline flaws across three tools simultaneously.

Rovo is the same story on an enterprise scale. The AI has access to everything the user can see. The attack surface is every document in the system. The fix, when it comes, will probably be something mundane like output filtering or permission scoping. But until then, the math is simple: if your AI can read it, an attacker might be able to steal it.

The question is not whether Atlassian will patch this. They will. The question is what other enterprise AI tools have the same vulnerability sitting undisclosed, unreported, and unexploited, until someone looks hard enough.