RovoBlast: Atlassian Rovo prompt injection could send Jira data outside

Two independent investigations into Atlassian Rovo demonstrated the same architectural problem: an assistant may legitimately read data available to a user, but it should not automatically gain permission to send that data to a destination supplied by an untrusted instruction. RovoBlast used a malicious link that preloaded a prompt. A second scenario placed instructions inside content being analysed.

This was not a conventional bypass of Jira or Confluence ACLs. The agent operated with the signed-in victim’s permissions. Risk emerged by composing three individually expected features: retrieving data, executing instructions in the chat context and requesting an external resource.

RovoBlast: instructions in a URL parameter

Varonis Threat Labs researchers described a link containing a rovoChatPrompt parameter. When an authenticated user clicked it, Rovo received instructions in that session. A demonstration retrieved a private API key from Confluence and transmitted it through a request to a researcher-controlled resource. The same model applied to information available through Jira and connected sources such as SharePoint or Outlook, always within the victim’s permissions.

Atlassian removed this path from the service on July 8, 2026, and the Bugcrowd report was marked resolved. SaaS customers have no local patch to install, but should still investigate events from the exposure period and reduce excessive data permissions.

Indirect prompt injection: a document becomes an instruction

PromptArmor described a separate variant in which instructions lived in content given to Rovo. The model was expected to treat the document fragment as data but also interpreted it as a command. It could then retrieve information available through connectors and encode it in an outbound request.

Disabling “web search” does not necessarily block that channel. Internet search and fetching a specific URL with a tool are different capabilities. The security-relevant matrix is: what data can the agent read, which network tools can it call, and does transfer to a new domain require approval?

The Rovo action documentation shows how agents can be extended with actions. Each action should have narrow permissions and an explicit data contract instead of automatically inheriting a user’s complete authority.

Defensive model: separate retrieval from export

1. Assign Rovo owners and inventory active agents, connectors, data sources and available actions. Prompt-injection scope cannot be established without this map.
2. Reduce user access in Confluence, Jira and connected services. An agent cannot disclose information that the user’s session cannot retrieve.
3. Require confirmation before contacting a new domain, sending a message, creating a webhook or writing data outside its source application.
4. Block dynamic destinations at egress and record exact target hosts, methods and response sizes. A broad list of “trusted SaaS” domains is insufficient.
5. Treat issue text, pages, attachments, email and connector results as untrusted data. Preserve their provenance in the agent context.
6. Test indirect prompt injection with canary secrets and synthetic datasets rather than production information.
7. Alert when one conversation combines access to high-sensitivity data with an outbound connection or a subsequent write action.
8. Retain a decision trail: original input, retrieved fragments, tool calls, target domain and user identity.

Facts and Breachroad analysis

Public reports describe two techniques: RovoBlast’s preloaded prompt and a separate indirect prompt injection. Atlassian removed the first variant from the service; that does not make every prompt-injection route one resolved bug. Separating permission to retrieve from permission to exfiltrate is Breachroad’s control model derived from both chains.

AI security training gives data owners, SaaS administrators and SOC teams a shared language for agent risk. An AI security assessment maps actual connectors, tools, egress and approval paths.