Attacker-controlled instructions can manipulate **Atlassian's Rovo** assistant to collect data from **Jira** or **Confluence** that a signed-in user can access, subsequently transmitting it to an external server. This concerning behavior was independently discovered by two security firms through different attack vectors. Crucially, only one of these vectors has been confirmed as remediated. ### Content-Borne Prompt Injection **PromptArmor**, an AI security firm, demonstrated an indirect prompt-injection attack where instructions were hidden within content that **Rovo** processed. Their research, published on August 5, 2026, indicated that an uploaded file was sufficient to prompt the assistant to gather internal data and exfiltrate it via a URL request, bypassing any separate approval steps. Notably, **PromptArmor** stated that this attack chain remained effective even with **Rovo's** web-search option disabled. This suggests the outbound request leveraged a separate URL-retrieval capability, not governed by the web-search setting. The firm disclosed the issue to **Atlassian** on May 23, 2026, but reported no further communication before publishing their findings. In their published example, a user uploads a document containing a concealed injection and asks **Rovo** to organize **Jira** tickets. **Rovo** then searches **Jira** and **Confluence**, appends the found data to an attacker's URL, and opens it, allowing the attacker to retrieve ticket and page contents from their server logs. The victim sees no indication of the exfiltration.  **PromptArmor** also noted that **Rovo** renders Markdown images from model output, presenting a second potential avenue for data exfiltration, though a full chain through this route was not demonstrated. ### One-Click Link Flaw: RovoBlast Separately, **Varonis Threat Labs** discovered a vulnerability, dubbed **RovoBlast**, which involved embedding attacker instructions within a link. They found that the `rovoChatPrompt` URL parameter could preload attacker instructions into **Rovo Chat**. A single click from an authenticated user would cause **Rovo** to execute these instructions with the user's privileges, sending the results to an attacker-controlled server. **Varonis** disclosed this issue through **Bugcrowd**. The disclosure confirms that **Atlassian** deployed a server-side fix for this flaw on July 8, 2026, and the fix was subsequently validated. The proof of concept demonstrated the exfiltration of a private API key from **Confluence**, and the technique was also successfully tested against **Jira** and data accessible via **SharePoint** and **Outlook** connectors. This vulnerability was rated P2 on **Bugcrowd's** priority scale and resulted in a $6,000 bounty.  ### Impact and Mitigation Neither issue requires a customer-applied patch. The **RovoBlast** link flaw was addressed server-side by **Atlassian**. For the content-borne path, the primary lever for mitigation lies in carefully scoping which applications and user groups can utilize **Rovo** at all. **Rovo's** data access adheres to permissions configured within **Atlassian** products and connected third-party applications. Therefore, the demonstrated risk involves data accessible by the signed-in victim, rather than a tenant-wide authorization bypass. However, these demonstrations highlight a mechanism for authorized data to be exfiltrated without the user's explicit intent. **Rovo** is enabled by default for apps on Standard, Premium, and Enterprise plans, with all organizational members able to use its features. Administrators can manage **Rovo** access by blocking features for supported apps, which disables current and upcoming AI capabilities like Agents and Chat. Enterprise plans offer more granular control, allowing management by app and user group. It's important to note that if multiple **Jira**-family apps are running on a single site, blocking **Rovo** for one app does not remove shared capabilities. **Rovo Search**, Chat, and Create with **Rovo** remain available as long as any **Jira** app on that site has **Rovo** enabled. While the link flaw is resolved, organizations should review **Rovo** access for apps and groups, tighten underlying permissions and connector scope, and avoid relying solely on the web-search toggle as a comprehensive security measure for the content-borne risk. As of August 8, 2026, neither disclosure reports evidence of these techniques being exploited in the wild.