Prompt Injection Turns Atlassian Rovo AI Into a Silent Data-Exfil Channel

PromptArmor has disclosed a set of flaws in Atlassian’s Rovo, the AI agent that reaches across Jira, Confluence, and connected third-party systems. Through indirect prompt injection, an attacker can drive Rovo to leak any data the agent can touch—tickets, documents, and connector data—across an entire tenant. The exfiltration runs with no human-in-the-loop approval and abuses Rovo’s URL-retrieval tool, which will open agent-constructed URLs without restriction.

The attack starts with poisoned content: commonly a file the victim uploads, but support tickets, web pages, or third-party connectors work equally well. When the user issues a benign request like organizing their Jira tickets, the hidden instructions make Rovo append sensitive data to an attacker-controlled URL and fetch it, at which point the attacker’s server logs everything in the request. Notably, disabling web search does not close the hole—the setting removes search but leaves the tool that opens results intact. A second vector exists through insecure Markdown image rendering in Rovo’s output. In the chat, the victim sees only ordinary ticket suggestions and no sign that data left the building.

The disclosure timeline is the sharpest part of the story. PromptArmor reported the issues to Atlassian on May 23; Atlassian opened a case and thanked them, then went silent through more than two months of follow-ups, leaving Rovo vulnerable at publication. Beyond the specific product, the findings underscore a recurring failure mode in agentic AI: broad data access combined with unconstrained tool use creates ready-made exfiltration paths, and toggling off a user-facing feature often does nothing to revoke the underlying capability.