Two separate security research teams found two separate ways to make Atlassian's Rovo AI assistant leak your organization's data this month. They published independently, a few days apart, and together they tell a story that matters if you're running Jira and Confluence.
The quick summary: Rovo — Atlassian's AI assistant that spans your Jira tickets, Confluence pages, Bitbucket code, and connected tools like Slack, Microsoft 365, and Google Workspace — can be manipulated via prompt injection to send your internal data to an attacker. One technique was patched. One may not be. And the admin setting Atlassian points you to doesn't actually stop the unpatched one.
Here's what happened and what to do about it.
The DEF CON disclosure: RovoBlast
Yesterday at DEF CON, Varonis Threat Labs published details of RovoBlast, a one-click prompt injection attack against Rovo. The technique is straightforward: an attacker sends a specially crafted link to a logged-in Rovo user. One click, and attacker-controlled instructions get seeded directly into the victim's active AI session.
No jailbreak. No special permissions. Rovo simply treated the external input as trusted.
From there, Rovo would execute those instructions using the victim's own access — reading Confluence pages, pulling Jira tickets, surfacing API keys and identity information, anything the victim could normally see. Then exfiltrating it.
The good news on this one: Atlassian deployed a server-side patch in early July and Varonis validated it before going public. If you're on Atlassian Cloud, the RovoBlast fix is already applied.
The one that isn't fixed
Five days before the Varonis disclosure, PromptArmor published a different technique — and this one may still be live.
It's zero-click. No crafted link, no user action required. An attacker embeds hidden instructions inside any file, page, or external document. When Rovo processes content containing that payload — a user asks Rovo to summarize a batch of Confluence pages, or scan through Jira tickets — Rovo reads the embedded instructions and follows them. It uses its built-in URL retrieval tool to silently send data to wherever the attacker specified.
Here's where it gets worse: Atlassian tells admins that disabling Rovo's web search feature stops this class of attack. It doesn't.
Turning off web search removes the ability to query search engines. It does not remove Rovo's URL retrieval tool — the underlying capability that actually carries the data out. You can flip that admin toggle and still be fully exposed to this technique. The fix gives a false sense of closure.
PromptArmor disclosed this to Atlassian on May 23, 2026. They followed up multiple times over the next two months. With no response and no patch on the way, they went public. The Hacker News coverage from this week has the full timeline if you want it.
What's actually in scope
Rovo isn't a chatbot sitting off to the side. It's an AI layer built directly on top of your Atlassian ecosystem, with access to Jira, Confluence, and Bitbucket — plus any connected integrations, which can include Slack, Microsoft 365, and Google Workspace.
Think about what that actually covers. Project plans, HR notes, grant applications, client contracts, board minutes, financial documents, deployment credentials left in ticket comments. Anything you and your team can reach through those platforms, Rovo can reach.
And Rovo is enabled by default on many Atlassian Cloud plans, often without a dedicated decision about what it should or shouldn't have access to.
A prompt injection attack through an AI assistant is different from a typical credential breach. The attacker doesn't need your password or network access. They just need to get their instructions into content that Rovo will eventually process — a shared Confluence page, a Jira ticket from a vendor or client, an external file linked in your docs — and the AI does the rest.
Who's in scope here
If you're running a small NGO, a municipal team, or an SMB in the 10-100 person range, the Atlassian stack is very common. Jira and Confluence are the default upgrade path for teams that have outgrown shared drives.
That means Rovo is present in a lot of organizations that aren't thinking about AI security at all — because they didn't make a deliberate choice to adopt an AI assistant. They were just running Jira, and Rovo showed up.
What to do
For RovoBlast (patched): If you're on Atlassian Cloud, the fix is applied server-side. Make sure your plan is current and no one is running a stale self-hosted version.
For the PromptArmor issue (unpatched):
-
Don't trust the web search toggle as a fix. It doesn't stop URL-based exfiltration. Atlassian needs to revoke the URL retrieval tool for the toggle to be meaningful — and as of this writing, that hasn't happened.
-
Audit Rovo's integrations. Pull up the Rovo admin settings and review what's connected. Slack, M365, Google Workspace integrations expand the blast radius. Disconnect what isn't actively needed.
-
Restrict Rovo's scope. Limit which Confluence spaces and Jira projects Rovo can read. Most organizations have spaces that contain sensitive information that genuinely doesn't need AI access.
-
Watch the Atlassian security advisories page. PromptArmor disclosed in May with no response. Don't assume this is being actively worked on. Watch for an update and push for one if you're an enterprise customer.
-
Consider temporarily suspending Rovo if you're handling sensitive Confluence or Jira content and can't do a proper audit quickly. Better to slow down AI-assisted summarization for a week than to run a live exfiltration risk on your entire document base.
What both findings add up to
Two independent research teams found two different ways to pull data through the same AI assistant in the same month. That's not coincidence. That's what happens when an AI layer gets full access to an organization's entire tool stack without being treated as a security surface.
The pattern is consistent with what we've seen across other AI assistants this year: the more access you grant to make the AI useful, the bigger the potential damage when a vulnerability appears. Rovo is genuinely useful. But access needs to be deliberately scoped, not accepted at defaults.
For any team running the Atlassian stack: you've probably never sat down and asked "what can Rovo actually see, and should it?" Now is a good time. We help organizations do exactly that — map out what their AI tools can access and put real boundaries in place before a researcher at a conference does it for you.