A critical one-click vulnerability in Atlassian Rovo AI allowed attackers to weaponize the enterprise AI assistant against its own users — exfiltrating private API keys, Jira tickets, Confluence content, and data accessible through SharePoint and Outlook connectors with nothing more than a specially crafted URL.
The RovoBlast Attack: Parameter-to-Prompt Injection
Researchers at Varonis Threat Labs disclosed a vulnerability they named RovoBlast, which exploits a flaw in how Rovo's chat interface handles URL parameters. A malicious link containing a rovoChatPrompt parameter preloads attacker-controlled instructions directly into a victim's live Rovo AI session the moment they click it. Rovo then executes those instructions with the victim's full permissions, including access to all connected enterprise data sources.
In a proof-of-concept demonstration, the attack successfully exfiltrated a private Confluence API key to an external attacker-controlled server. The same technique was verified against Jira and data reachable through Microsoft 365 and Google Workspace connectors.
The Varonis team classified this as a parameter-to-prompt (P2P) injection — the same vulnerability class they previously uncovered in Microsoft Copilot (dubbed "Reprompt" in January 2026). A particularly notable detail: leaving the organization ID field blank in the crafted URL did not stop the attack — Atlassian's backend still routed the request into the victim's default organization.
Amplification via ResearchAgent
The blast radius is significantly expanded by Rovo's built-in ResearchAgent tool, which autonomously traverses multiple data sources during a single session. When hijacked via a RovoBlast payload, the agent can pivot across Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, uploaded files, relational databases, and web-accessible content — all within a single click.
According to Rovo's own self-reporting when queried, the full scope of accessible data includes archived content going back years.
Atlassian paid a $6,000 bug bounty and patched the vulnerability server-side on July 8, 2026. No client action is required for the RovoBlast vector.
A Second Vulnerability: Zero-Click Prompt Injection (Unpatched)
Concurrent research by PromptArmor revealed a separate and more persistent attack vector: indirect prompt injection via documents. Reported on May 23, 2026, this flaw remains unpatched as of August 5, 2026.
The attack embeds hidden instructions inside documents that Rovo processes — white-on-white text, 1-point font, or 0.1-point line spacing in PDFs disguised as legitimate SOPs. When a user asks Rovo to process a Jira ticket or Confluence page containing or linked to such a document, Rovo's URL retrieval tool is hijacked by the injected instructions to silently POST sensitive data to an external server.
Bypassing Admin Controls
This attack works even when organization-wide web search is disabled in Rovo's admin panel — disabling web search does not remove the underlying URL retrieval capability, which remains exploitable as an exfiltration channel. PromptArmor also identified a secondary path: Rovo renders images embedded in AI responses, and image URL parameters can carry exfiltrated data payloads out of the enterprise perimeter.
Scale of Exposure
Atlassian Rovo has over 5 million monthly active users and is deployed at 75% of Fortune 500 companies, with adoption in over 90% of Atlassian's enterprise customer base. The combination of broad enterprise data access and autonomous agent capabilities makes AI assistant vulnerabilities in this product a high-severity concern.
Broader Context
The indirect prompt injection pattern found in Rovo is not unique to Atlassian. The same fundamental vulnerability class has been documented in Claude integrations, Google Workspace AI, Slack AI, and Notion AI. The core architectural problem — LLMs that cannot strictly separate data from control instructions — is an industry-wide challenge that no vendor has fully resolved.
What Organizations Should Do
- RovoBlast (patched): No client-side action required; Atlassian deployed the fix server-side on July 8, 2026
- Indirect prompt injection (unpatched): Monitor for unusual Rovo activity; be cautious about allowing Rovo to process documents from external or untrusted sources; check PromptArmor's disclosure for the latest patch status
- Audit connected integrations: Review which external data sources (SharePoint, Outlook, Google Workspace, Slack) are connected to Rovo and assess the data exposure risk
- Watch for Atlassian's patch: Track CVE assignments and Atlassian's security advisories for the indirect prompt injection fix