Executive Summary
Two firms independently found that attacker-controlled instructions can make Atlassian's Rovo collect Jira or Confluence data a user can access and send it to an outside server; only one route is confirmed fixed.
What Happened
Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was
Affected Products
- Atlassian Rovo
- Jira
- Confluence
Vulnerability / Attack Technique
Indirect prompt injection leading to exfiltration
Technical Mechanism
PromptArmor hid instructions in content Rovo reads, including an uploaded file; Rovo then gathered data and sent it externally.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
With one route still open, the risk is live. RealGround analysis: limit Rovo's outbound capabilities until both paths are confirmed fixed.
Recommended Controls
- Restrict Rovo from sending data to external URLs
- Review files and pages Rovo can read for planted instructions
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.