Atlassian Rovo AI Leaks Jira and Confluence Data via Hidden Prompt Injection
Atlassian Rovo Exfiltrates Data, Bypassing Controls
PromptArmor discovered that Atlassian's Rovo AI can be tricked into exfiltrating sensitive data, including Jira tickets and Confluence documents, through indirect prompt injection. The attack exploits Rovo's URL retrieval tool, which lacks protections against dynamically created URLs, and works even when web search is disabled. Disclosed to Atlassian in May, the issue remains unpatched after two months of follow-ups.
The attack still succeeds even when web search has been disabled organization-wide.
- kevcampb
Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training.
https://news.ycombinator.com/item?id=47833247
This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.
- simonw
> Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL.
I think it was Anthropic that first introduced a pattern that completely locks this down: your URL retrieval tool should only work for URLs that have previously been typed into the conversation by a user or have been returned from a trusted tool.
If the agent itself concatenates a new URL together - with leaked data after a ? - you should block that from being fetched.
The great thing about this solution is it's deterministic. You don't need any extra AI in the max - you implement a URL fetching system that knows which sources it should check for a direct match on the URL before it makes that GET request.
- pram
I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere.
It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.
- hahahaa
> The victim uploads a file to Rovo that contains a hidden prompt injection
Yeah this attack is possible on all modern agentic systems.
* Access to your private data
* Exposure to untrusted content
* The ability to externally communicate in a way that could be used to steal your data
(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)
And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.
- john_strinlai
~every ai vulnerability write up boils down to "just ask it do to the thing", but with fancier terms like "indirect prompt injection".
- ExoticPearTree
Rovo is funny. It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.
- ohaodha
I find it difficult to be impressed by "prompt injection" attacks that require the victim to enter the malicious prompt themselves --- like, really? If you tell Rovo to exfiltrate your data, it'll do it?
Obviously, there should be URL protection rules to control what it can access, but this requires a very specific and unlikely set of circumstances to exploit.
- hughw
Related: A few days ago, Jira opted everyone in by default to "Contribute in-app data to improve Atlassian apps for everyone"