By ByteBot
Security researchers at PromptArmor disclosed active prompt injection vulnerabilities in Atlassian Rovo this week that allow silent data exfiltration across an entire Atlassian tenant — and the organizational control you were told would stop it leaves your data fully exposed. After more than two months of silence from Atlassian following private disclosure, PromptArmor went public. The vulnerability remains unpatched.
The Admin Control That Isn’t
Here’s the part that should concern you most: Atlassian provides an org-level toggle to disable web search for Rovo. Security-conscious teams that found this setting and turned it off believe they’ve limited Rovo’s ability to reach external systems. They haven’t. PromptArmor confirmed that disabling web search removes the visible interface but leaves Rovo’s underlying URL retrieval tool active in its toolset. The tool doing the actual data exfiltration is still there.
This isn’t a nuance buried in fine print. It means every organization that took the responsible step of locking down Rovo’s external access is no more protected than one that never touched the setting. Security theater at enterprise scale.
How the Attack Works
Indirect prompt injection is the mechanism. An attacker embeds hidden instructions inside content that Rovo will process as part of a normal task — an uploaded file, a support ticket, data pulled from a third-party connector. When a user asks Rovo to do something legitimate (“summarize my open Jira issues”), Rovo processes the malicious content as part of its response and gets hijacked mid-task.
The exfiltration method is almost elegant in how mundane it looks: Rovo appends sensitive data to a URL on an attacker-controlled server, framed as “viewing an image.” Rovo fetches the URL. The server logs capture the data. The victim sees ordinary Rovo output. No approval dialog. No visible action. Nothing to click.
What’s in scope for exfiltration: all Jira tickets the user can access, all Confluence pages, internal documents, and data from any active connectors — SharePoint, Outlook, and GitHub integrations included. For a comprehensive breakdown of the attack mechanics, see the PromptArmor full disclosure.
Atlassian’s Two-Month Non-Response
PromptArmor followed responsible disclosure protocol and reported privately to Atlassian on May 23, 2026. Atlassian issued a case number and went quiet. After multiple follow-ups over two months with no further communication, PromptArmor published.
The contrast with a prior Rovo vulnerability makes this harder to excuse. A separate attack — discovered by a Bugcrowd researcher in November 2025 — exploited the rovoChatPrompt URL parameter to execute attacker-supplied prompts against authenticated users. Atlassian triaged that one, paid a $6,000 bounty, and shipped a fix in July 2026. They can move when they choose to. They didn’t here.
“We are publishing to inform users of the risks given the lack of progress from Atlassian’s side.”
PromptArmor
Why This Matters at Scale
Rovo isn’t a niche add-on. It has surpassed 5 million monthly active users and is deployed at 75% of Fortune 500 companies and more than 90% of Atlassian enterprise customers — per Atlassian’s own Q2 FY26 shareholder data. That’s a lot of Jira tickets, a lot of internal docs, and a lot of organizations running on a platform with an unpatched data exfiltration vector.
And this isn’t an Atlassian-specific problem. The same attack pattern has surfaced in Claude integrations, Google Workspace AI, Slack AI, and Notion AI. What’s different here is scale — and the broken admin control that gave teams false confidence they’d addressed the risk.
What to Do Right Now
There is no patch available for the PromptArmor-disclosed vulnerability as of publication. Here’s what you can actually do:
- Do not rely on the “disable web search” toggle as a security control. It doesn’t remove the relevant capability.
- Audit your active connectors. Every connected system — SharePoint, Outlook, GitHub, external ticketing tools — expands the data at risk. Remove connectors to highly sensitive systems until Atlassian ships a fix.
- Enterprise plan users: You can remove Rovo product access entirely for specific user groups via Directory > Product access in Atlassian Administration. This is the most effective control available right now.
- Watch Atlassian’s security advisories for a patch.
- Scope Rovo’s access aggressively. The narrower the data it can reach, the smaller the blast radius of any injection attack.
Prompt injection in agentic AI tools is not going away. It’s a structural property of how LLMs process untrusted content, and it compounds with every additional data source an agent can access. The answer isn’t to avoid AI agents — it’s to build and configure them with least-privilege architecture from the start. Rovo’s architecture doesn’t do that, and the admin controls don’t compensate for it.
Atlassian owes its enterprise customers a patch and an explanation for two months of silence. Until that patch ships, treat Rovo as having access to everything you let it access — because an attacker can too.
