Atlassian Rovo: one click leaked Jira and Confluence data

Two security teams, working independently, published two different ways to make Atlassian's Rovo assistant hand company data to an outsider — in the same week. Neither needed a jailbreak. One needed a single click on a link. Atlassian Rovo data exfiltration is not an interesting bug; it is the predictable result of bolting an agent with 50+ connectors across Jira, Confluence, Bitbucket, Slack, Microsoft 365, and Google Workspace.

What actually happened

Varonis Threat Labs called their finding RovoBlast. Rovo's chat interface accepted a rovoChatPrompt URL parameter that preloaded text straight into the chat window — no warning, no confirmation, no indication the session had been seeded by someone else. Leaving the organization ID blank in the URL made Atlassian route the request into the victim's own default org, which removed the last piece of friction for an attacker crafting a link.

One click from an authenticated user was enough. The prompt then ran with that user's privileges, and Rovo's ResearchAgent tool — designed to pull from internal sources and reach out to the web across multi-step tasks — carried the results to an attacker-controlled server. Varonis's summary: "No jailbreaks, no permission bypass, and no warnings or confirmation." They classify it as parameter-to-prompt injection, the same pattern they reported in Microsoft Copilot in January. Atlassian fixed it server-side on July 8; the Bugcrowd report was marked resolved August 8 and paid a $6,000 P2 bounty.

PromptArmor found the other door. Their research, disclosed to Atlassian on May 23 and published August 5, hides instructions inside a document that Rovo later processes. The assistant reads the file, follows the buried instructions, collects what it can reach, and sends it out — with no extra approval step. Atlassian's guidance there is administrative: restrict Rovo by app and by user group.

No CVE was assigned to either. Neither team reported confirmed exploitation in the wild, per The Hacker News.

Why this matters for your business, not just Atlassian's

The detail everyone under-reads: exfiltration was bounded by what the signed-in user could already access. That sounds like a limit. It isn't. It means your blast radius equals the permissions of the most over-provisioned person who clicks a link — and in most small companies, that person is an owner or an admin with access to everything.

An AI assistant wired across your SaaS estate is a permission amplifier. It collapses "could this employee technically find that document" into "will this employee's assistant fetch it in four seconds and post it somewhere." Two independent teams found two unrelated routes in one week. The class of problem is the finding; the individual bugs are footnotes.

Three things to do regardless of vendor. Scope the assistant per group, not per tenant — most orgs enable it company-wide because that's the default. Audit which connectors are live, and turn off the ones nobody asked for. Treat any agent that can both read internal data and reach the open internet as one privilege, not two — that combination is the exfiltration path, and it's a design choice you can decline.

Sources: Varonis Threat Labs, PromptArmor, The Hacker News.