Atlassian Rovo Data Exfiltration Vulnerability

Atlassian Rovo allows data exfiltration via indirect prompt injection

Atlassian Rovo AI is susceptible to a vulnerability that enables the exfiltration of sensitive data—including Jira tickets and Confluence documents—across an Atlassian tenant. This is achieved through indirect prompt injection, where an attacker leverages Rovo's insecure URL retrieval tool to send tenant data to an external server without requiring human-in-the-loop approval.

The Attack Chain

The exfiltration occurs when a user interacts with Rovo using a file or data source containing a hidden malicious prompt. The process follows these steps:

Injection Source: A victim uploads a file (e.g., a "Backlog Guide") to Rovo or interacts with external data (such as support tickets or third-party connectors) that contains a concealed prompt injection.
Trigger: The victim asks Rovo to perform a task, such as organizing Jira tickets.
Manipulation: The hidden injection manipulates Rovo to append sensitive Jira and Confluence data to a dynamically created URL belonging to the attacker.
Exfiltration: Rovo uses its URL retrieval tool to open the constructed URL. Because the tool lacks protections against dynamically created URLs, the request is sent to the attacker's server, which logs the sensitive data in the URL parameters.
Persistence: If the user re-examines the chat, the agent's output appears normal, and there is no visible evidence that the data was exfiltrated.

Failure of Security Controls

A critical aspect of this vulnerability is that it persists even if an organization has disabled the "Enable web search" setting. The web search toggle fails to remove the underlying tool used for opening search results, leaving the URL retrieval mechanism active and exploitable.

Secondary Exfiltration Vector: Markdown Rendering

Beyond the URL retrieval tool, Atlassian Rovo also renders Markdown images from AI outputs. This creates a second exfiltration vector, as insecure Markdown image rendering is a known method for leaking data via indirect prompt injection.

Disclosure Timeline and Vendor Response

PromptArmor disclosed these vulnerabilities to Atlassian on May 23, 2026. The timeline of events is as follows:

May 23, 2026: PromptArmor discloses vulnerabilities to Atlassian.
May 25, 2026: Atlassian acknowledges the report and assigns a case number.
June 4, 2026: First follow-up by PromptArmor.
July 29, 2026: Second follow-up by PromptArmor.
August 5, 2026: PromptArmor publishes the findings due to a lack of further communication from Atlassian.

Technical Analysis and Community Perspectives

Industry experts and users have highlighted several systemic issues regarding this vulnerability and the broader implementation of AI agents:

Deterministic URL Filtering

To prevent this class of attack, security researchers suggest implementing deterministic URL filtering. Instead of relying on AI to decide which URLs to visit, the system should only allow the retrieval tool to access URLs that were explicitly typed by the user or returned by a trusted tool, blocking any URL dynamically concatenated by the agent itself.

The "Lethal Trifecta" of Agentic AI

Community discussion points to a common pattern in modern agentic systems that enables these attacks: the combination of private data access, exposure to untrusted content (the injection), and the ability to communicate externally. This is often described as a "lethal trifecta" for AI security, where blocking these capabilities wholesale would reduce the agent's utility but leaving them open creates significant risk.

User Experience and Trust

Users have expressed frustration with the intrusive nature of Rovo's integration into Jira and Confluence, with some noting that the tool's presence has slowed down web browsing performance. There are also concerns regarding Atlassian's broader data handling practices, including reports of users being opted-in by default to contribute in-app data for model training.