An AI Assistant Too Well Integrated to Be Safe
Atlassian Rovo markets itself as an "AI teammate": it aggregates data from Jira, Confluence, SharePoint, Slack, Google Workspace, and around fifty other platforms to answer employee questions on demand. That deep integration is precisely what made it an attractive target.
Two separate vulnerabilities, disclosed in early August 2026, show that the productivity promise comes with an unprecedented attack surface — one that traditional security controls are largely blind to.
RovoBlast: A URL Parameter as the Trigger
The first flaw, dubbed RovoBlast by researchers at Varonis Threat Labs and presented at DEF CON 34, exploits a URL parameter called rovoChatPrompt. This parameter allowed attackers to pre-fill the Rovo chat interface with arbitrary instructions — instructions the assistant would execute as if they had come from the user.
No jailbreak. No classic application exploit. All it takes is for an authenticated user to click a crafted link. Rovo then takes over through its ResearchAgent component — an internal tool capable of autonomously navigating connected systems and sending data to external URLs. The result: Jira tickets, Confluence pages, and SharePoint documents could be silently routed to a server under the attacker's control.
Atlassian patched RovoBlast server-side on July 8, 2026, ahead of Varonis's public disclosure. Worth noting: the same research team had uncovered a similar flaw — nicknamed "Reprompt" — in Microsoft Copilot back in January 2026. The "parameter-to-prompt" attack vector is not unique to any single vendor; it is emerging as a vulnerability class in its own right across enterprise AI assistants.
The Unpatched Flaw: Injection via Uploaded File
The second vulnerability, uncovered by PromptArmor, takes a different route. An attacker embeds malicious instructions inside an ordinary-looking document — a backlog guide, a sprint review summary. When a colleague later asks Rovo to analyze that file, the assistant follows the hidden instructions, constructs URLs carrying sensitive data pulled from Jira or Confluence, and sends them outbound. The attacker simply checks their server logs.
What makes this variant especially concerning: it works even when web search has been disabled in the organization's settings. Turning off that toggle does not remove the underlying URL-fetching tool Rovo uses to build exfiltration requests.
PromptArmor notified Atlassian on May 23, 2026. After more than two months of follow-ups with no response and no patch, the firm published its findings on August 5 to alert IT and security teams directly. At the time of publication, the vulnerability remained unpatched.
When Admin Controls Are No Longer Enough
Both incidents point to a structural challenge for IT and security teams: how do you audit what an AI assistant can actually do with internal data, when the controls exposed in the admin interface don't reflect the real capabilities of the underlying agent?
WAFs, DLP tools, and SIEMs are not designed to intercept natural-language requests issued by an AI agent to its connectors. And the permissions Rovo holds across its fifty-odd integrations are not trivial read-only access — they represent a unified data collection surface that any malicious prompt can mobilize within seconds.
Before extending an AI assistant's reach across the full breadth of corporate data, auditing the tools actually accessible to the agent — not just those declared in the admin console — must be treated as a security prerequisite in its own right.