Atlassian Rovo AI Vulnerable to Data Exfiltration via Prompt Injection
Security firm PromptArmor discloses vulnerabilities in Atlassian's Rovo agent that enable attackers to steal Jira tickets and Confluence documents through indirect prompt injection.
Conversation activity · last 5 days peak 1/hr
Summary, timeline and people extracted by Claude from 10 items across 2 sources · 15h ago. Quotes are verbatim.
PromptArmor disclosed vulnerabilities in Atlassian's Rovo AI agent that allow attackers to exfiltrate sensitive data including Jira tickets and Confluence documents via indirect prompt injection. The vulnerability exploits Rovo's URL retrieval tool, which lacks protections against agent-constructed URLs and persists even when web search is disabled. PromptArmor reported the issue to Atlassian on May 23, but after two months and multiple follow-ups without remediation, publicly disclosed the vulnerability on August 5.
- Atlassian Rovo allows indirect prompt injection attacks that exfiltrate Jira tickets and Confluence documents without user approval, even with web search disabled.
- PromptArmor disclosed the vulnerabilities May 23 but went public after two months of silence from Atlassian; Rovo remains unpatched.
- The core vulnerability: Rovo's URL retrieval tool lacks protections against agent-constructed URLs and can be manipulated to append sensitive data to attacker-controlled endpoints.
- Users report additional issues including unwanted data downloads to AWS and page load degradation, alongside concerns about Atlassian's default opt-in for model training.
How it unfolded
-
Reaction Story resurfaces on Mastodon
Security researcher David Gerard shares the vulnerability report on Mastodon, drawing attention to Rovo's susceptibility to prompt injection attacks.
-
Reaction Atlassian's default opt-in for model training resurfaces
HN commenter reminds community that Atlassian defaults customers into data sharing for model training, with opt-out deadline August 17.
“Atlassian opted-in all customers by default for their data to be used for model training. This goes live on August 17.”
kevcampb · Hacker News ↗ -
Reaction Operator reports Rovo downloading all organizational documents
HN commenter shares firsthand account of AWS IPs downloading all organizational docs via Rovo without explicit request.
“It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint.”
ExoticPearTree · Hacker News ↗ -
Reaction Users report performance and usability issues
HN commenter reports Rovo has degraded Jira and Confluence performance by injecting code into every page while being less useful than alternatives.
“they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.”
pram · Hacker News ↗ -
Report PromptArmor publicly discloses Rovo vulnerabilities
After more than two months without further communication from Atlassian and Rovo remaining vulnerable, PromptArmor publishes detailed analysis of the attack chain via indirect prompt injection.
“Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable.”
PromptArmor · Hacker News ↗ -
Reaction Security community responds on Hacker News
The disclosure hits #4 on Hacker News with 302 points and 137 comments, sparking discussion about Rovo's design flaws and the broader risks of agentic AI systems with access to sensitive data.
- 11 weeks quiet
-
Event PromptArmor discloses vulnerability to Atlassian
PromptArmor reported data exfiltration vulnerabilities in Atlassian Rovo to the company, which assigned a case number and acknowledged receipt.
What people are saying verbatim
“Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable.”
PromptArmor, Security researcher · PromptArmor report (Hacker News) ↗ · Aug 4
“Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent.”
PromptArmor, Security researcher · PromptArmor report ↗ · Aug 4
“This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.”
PromptArmor, Security researcher · PromptArmor report ↗ · Aug 4
“Wow, great work Atlassian. The web search setting does not disable web search.”
mvdtnz, HN commenter · Hacker News ↗ · Aug 4
“It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.”
ExoticPearTree, HN commenter · Hacker News ↗ · Aug 4
“they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.”
pram, HN commenter · Hacker News ↗ · Aug 4
“Atlassian opted-in all customers by default for their data to be used for model training. This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.”
kevcampb, HN commenter · Hacker News ↗ · Aug 5
Voices from the web unedited
-
of course atlassian's llm is prompt injectable https://www. promptarmor.com/resources/atla ssian-rovo-exfiltrates-data
-
> Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL.I think it was Anthropic that first introduced a pattern that completely locks this down: your URL retrieval tool should only work for URLs…
-
> The victim uploads a file to Rovo that contains a hidden prompt injectionYeah this attack is possible on all modern agentic systems.* Access to your private data* Exposure to untrusted content* The ability to externally communicate in a way that could be used to steal your data(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)And…
-
Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training.https://news.ycombinator.com/item?id=47833247This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.
-
I find it difficult to be impressed by "prompt injection" attacks that require the victim to enter the malicious prompt themselves --- like, really? If you tell Rovo to exfiltrate your data, it'll do it?Obviously, there should be URL protection rules to control what it can access, but this requires a very specific and unlikely set of circumstances…
-
I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere.It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.
-
Rovo is funny. It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.
-
> Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.Wow, great work Atlassian. The web search setting does not disable web search.
-
~every ai vulnerability write up boils down to "just ask it do to the thing", but with fancier terms like "indirect prompt injection".