RovoBlast: One Click Could Leak Jira and Confluence Data

A crafted Atlassian link was enough to seed attacker instructions into an authenticated Rovo session and turn the enterprise AI assistant against the data it was meant to organize. Varonis Threat Labs calls the vulnerability RovoBlast. The researchers say the attack required one click, no jailbreak, no permission bypass and no confirmation before Rovo began acting on the supplied prompt.

Atlassian fixed the reported vulnerability before the research was published at DEF CON 34. There is no public evidence that RovoBlast was exploited against customers. It is still major cybersecurity news because it demonstrates a failure mode that applies to every enterprise assistant connected to internal knowledge: the AI can respect a user's permissions perfectly and still leak the data those permissions allow it to read.

The entry point was a normal Rovo URL

Rovo Chat supported a URL parameter named rovoChatPrompt. Its purpose was convenience: a link could open Rovo with a prompt already supplied. In the vulnerable flow, externally supplied content crossed directly into the trusted chat session as instructions.

Varonis describes this class as parameter-to-prompt injection. It is the AI-era version of a familiar boundary error: data from a URL is treated as executable intent. The victim did not need to paste a payload, upload malware or approve a connector. Clicking a link on an Atlassian domain placed the attacker's prompt inside a session that was already authenticated in the browser.

This is why “the link points to a trusted domain” is not an adequate phishing control. The origin was legitimate. The dangerous part was the instruction encoded in the URL and what the application did with it after navigation.

Why Rovo's legitimate access created the blast radius

Rovo is not a standalone chatbot with an empty context window. It combines search, chat and agent actions across Jira, Confluence and Bitbucket, and can connect to platforms such as Slack, Microsoft 365 and Google Workspace. It operates with the logged-in user's existing access.

That last sentence is often presented as the security guarantee: the assistant cannot read what the user cannot read. RovoBlast did not break that guarantee. It showed why the guarantee is incomplete. An attacker who can control the assistant's instructions can ask it to find everything the victim can read, summarize the most valuable parts, and move the result toward an external channel.

Jira tickets routinely contain incident details, customer reports, internal URLs and debugging credentials. Confluence holds architecture documents, runbooks and commercial plans. Connected mail and file services extend the searchable surface again. AI removes the manual effort of discovering which buried page matters.

ResearchAgent supplied the exit path

Retrieving private data is only two-thirds of an exfiltration chain. The attacker also needs a way to send it out. Varonis focused on Rovo's ResearchAgent, which could perform multi-source web research and navigate external sites through multiple autonomous steps.

In the researchers' chain, a pre-seeded prompt could direct Rovo to search internal sources, transform the retrieved information, and use its browsing capability as the escape route. The actions ran under a legitimate identity and resembled normal AI-assisted research. Fewer visible interactions meant fewer opportunities for the user to notice or cancel the operation.

RovoBlast therefore combined three properties that are each useful on their own:

Untrusted input: a URL parameter became a prompt.
Private access: Rovo could search the victim's permitted enterprise data.
External communication: an agent could navigate beyond the internal trust boundary.

Put all three in one execution path and a single classification mistake becomes a data-leak primitive.

Fixed does not mean the governance problem disappeared

Atlassian's remediation closes the reported path. Security teams should not turn that into the broader conclusion that prompt injection is now solved. Rovo consumes more than URL parameters: documents, issues, pages, comments, repositories and connected sources can all contain attacker-controlled text.

Independent research published earlier in 2026 demonstrated indirect prompt injection hidden in Confluence content. Atlassian also has an open request for admin-visible detection and auditing of prompt-injection attacks. The specific one-click flow and the general content-to-instruction problem are related, but they are not the same bug and should not be collapsed into one patch status.

This resembles the lesson from the OpenAI–Hugging Face evaluation incident: an agent's permissions and its intent are separate security questions. A valid credential proves who is acting. It does not prove that the action reflects the human user's intention.

What Atlassian administrators should do

Confirm the remediation is present. Rovo is a cloud service, but security teams should still obtain Atlassian's incident or advisory reference for their assurance record rather than relying on a generic “SaaS is patched” assumption.
Inventory every Rovo connector. Disconnect sources that are not actively required. Each connector expands both the search surface and the number of possible exit paths.
Keep high-sensitivity repositories out of scope. Legal, M&A, HR, finance, credentials and incident-response evidence should not become assistant-readable merely because a user once received broad access.
Reduce the user's underlying permissions. Rovo inherits access; stale Confluence spaces, oversized Jira groups and organization-wide sharing become AI-searchable exposure.
Disable unused autonomous capabilities. Browsing and multi-step agents should be enabled for documented use cases, not as ambient defaults.
Monitor outcomes, not only logins. Alert on unusual agent runs, broad cross-product searches, repeated retrieval of sensitive pages and outbound requests carrying long or encoded parameters.
Red-team content ingestion. Test poisoned Jira issues, Confluence pages, attachments and connector content. A URL fix says nothing about instructions hidden in the next trusted document.

The new boundary is instruction provenance

Traditional authorization asks whether a principal may read a document or invoke a tool. Agentic systems need an additional decision: where did the instruction come from, and is that source allowed to direct this action?

A prompt typed deliberately by a user, text recovered from a Jira issue, a string supplied in a URL and a command embedded invisibly in an attachment cannot all carry the same authority. If the model sees them as one stream of tokens, the surrounding system has to preserve the distinction and enforce it before tools run or data leaves the organization.

RovoBlast is useful precisely because its mechanics were simple. The attack did not require a smarter model. It required the product to confuse external data with a trusted instruction, then let a highly connected assistant do exactly what it was built to do.