What Happened
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was
Why It Matters
The report says Atlassian Rovo can be manipulated through attacker-controlled instructions hidden in content or in a crafted Rovo chat link, causing it to collect Jira or Confluence data a signed-in user can access and send it to an attacker-controlled endpoint. One route was reportedly fixed server-side, while the content-borne indirect prompt-injection path was still described as open at publication. RealGround analysis: this is a strong fit for indirect prompt injection and data leakage risk, and it warrants testing agent guardrails, URL/tool-use controls, and tenant-scoped exfiltration paths.
RealGround Analysis
This signal maps to indirect prompt injection. Organizations using AI agents, LLM APIs, SaaS integrations, or sensitive data workflows should review whether this class of issue could create unauthorized tool execution, data leakage, weak approval gates, or unmanaged supply-chain exposure.
Recommended Actions
- Restrict AI agent tool permissions and production write paths.
- Review sensitive data access across prompts, logs, embeddings, memory, and SaaS integrations.
- Add human approval workflows for high-impact or state-changing actions.
- Run prompt injection and indirect prompt injection tests against affected workflows.
- Document the owner, control gap, and remediation deadline for this risk class.
Source
https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html