Two prompt injection paths into Rovo: one fixed (RovoBlast), one open.

[#1]

When I returned from vacation at the end of August and checked my feeds, I saw that the security community had spent the week focused on Rovo. Two research teams had published different prompt-injection methods for Atlassian's AI assistant just two days apart, one at DEF CON and one on a company blog.

At first, I looked for a Community article that explained what happened so I could share it with my team or customers. When I couldn't find one, I spent a few evenings reading the original versions of the reports instead of just the headlines. Then, I checked my own Atlassian Administration to see which recommended controls were actually available. Here’s what I found:

Path one: RovoBlast (already fixed)

Varonis Threat Labs presented this at DEF CON 34 and published it on 7 August 2026.

Rovo Chat accepted a URL parameter called rovoChatPrompt, which pre-filled the chat input. An attacker could add a full instruction to that parameter, send the link to someone, and if a signed-in user clicked it, the text would appear in their authenticated Rovo session as if they had typed it themselves.

There was no jailbreak, stolen credentials, or permission bypass. Rovo just followed the instructions, using the permissions of the user who clicked the link. In the proof of concept, Rovo collected information the victim could access, added it to the path of an attacker-controlled image URL, and fetched that image. The data then appeared in the attacker's server logs.

The researchers also noted that when they asked Rovo what it could access, it listed Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, uploaded files, web pages, and archived content. Connectors can reach much further than most people realize.

The good news is that this issue was reported through Atlassian's public Bugcrowd bug bounty program. Atlassian fixed it on the server side on 8 July 2026, a month before it was published, and the reporter confirmed the fix. There’s nothing you need to patch. This is exactly how a bug bounty should work.

Path two: Indirect injection via Markdown image exfiltration

PromptArmor published a different technique on 5 August 2026, two days before the DEF CON talk.

Instead of using a crafted link, this method relies on Indirect Prompt Injection. The malicious prompt is hidden within legitimate content that Rovo is asked to process, such as a Jira issue, a Confluence space, or an uploaded PDF. Once Rovo parses the content, it executes the hidden text and leaks sensitive data via Markdown-based dynamic image exfiltration, adding private details to a remote image request in the background. The user doesn’t do anything unusual; they just upload a document and ask Rovo to organize their tickets. Rovo does that, but also follows any secret instructions it finds in the content.

Two details from that report are especially important:

1. The exfiltration used Rovo's URL retrieval feature, which did not have meaningful restrictions on the URLs the agent could create. Markdown image rendering in the output was also identified as another possible channel.
2. Turning off web search at the organization level did not stop this. The URL retrieval tool was still available to the agent, regardless of the search setting.

This second point is important because turning off web search is usually the first step people take, myself included. If you’ve told a customer this would fix the issue, that advice needs to be updated.

I have found no public confirmation from Atlassian regarding the status of this second path, nor any independent reproduction in either direction. I am treating it as open. No CVE has been assigned to either finding.

This is not an Atlassian story

If you only follow Atlassian news, this might seem like just an Atlassian problem. It isn’t, and I believe it’s important for us as partners and Champions to make that clear.

The same Varonis team found the identical parameter-to-prompt pattern in Microsoft Copilot in January 2026, where they called it Reprompt. Before that, Aim Labs disclosed EchoLeak in Microsoft 365 Copilot in June 2025, a zero-click indirect injection via a crafted email. Then came ForcedLeak in Salesforce Agentforce in September 2025, which Aim Labs explicitly described as the same primitives applied to a different product, adding that these issues are endemic to retrieval-augmented agents.

OWASP has prompt injection as LLM01, the number one entry in its LLM Top 10, and the 2026 agentic edition maps it across most of the list. The clearest mental model I have found is Simon Willison's "lethal trifecta" from June 2025: an agent becomes exploitable when it has access to private data, exposure to untrusted content, and a means of communicating externally. Any two are fine. All three in one session, and content the attacker controls becomes an instruction the agent follows.

Rovo is useful precisely because it has all three. So is every competing assistant. That is the trade, and it is a trade we should be helping customers make deliberately rather than by default.

One observation on disclosure, while we are here. Our vulnerability-handling processes were built for code defects: there is a fix and a clear "resolved" state. A model that can be talked into something via text does not fit that shape neatly, making these timelines messier for researchers and vendors alike. We are all currently learning how to handle this class of finding, and I would rather see the whole industry get better at the process than pick on whoever happens to be in the headlines this week.

What I checked in my own Administration

I didn’t run any attacks. Instead, I went through Atlassian Administration like an admin to see what’s actually available today. Here’s what I found:

• You can’t turn Rovo off completely. Search, Connectors, and Studio are still available. However, you can block LLM features for each app under Rovo, and then block Rovo access. It’s now a blocklist instead of an allowlist.
• Connectors are the main risk area. Under Connectors, you can view every Teamwork Graph connector for each site. Some connector types, like Smart Link connectors, don’t need admin setup, so an inventory based only on the admin-managed list will be incomplete.
• There are blocklists for some connectors, such as Google Drive and SharePoint. In my experience, these are not used enough.
• You can control who can create agents. In Rovo Studio, you can limit the Create Agent permission to certain groups.
• The Rovo MCP server has its own domain and authentication controls, separate from the other settings. It’s easy to overlook.

A checklist you can hand to a customer

1. Start with an inventory. Is Rovo active? On which apps? With which connectors? For which groups? Most customers can’t answer these questions from memory.
2. Disconnect any connectors that aren’t being used. Idle connectors increase risk without adding value.
3. Don’t suggest that the web search toggle is enough to contain the risk. It wasn’t effective.
4. Use space and project permissions to keep Rovo away from HR, legal, finance, and security content. Rovo follows these permissions, so they are your best control.
5. Limit who can create agents, and carefully consider the risks of independent multi-step agents that can browse.
6. Treat all ingested content as untrusted, including third-party uploads, customer-submitted JSM tickets, and connector data.
7. Monitor agent activity for outbound requests to unexpected hosts. Chained steps within a single agent run can look like normal research in the audit trail.

If you’re interested in the governance side, the AI privacy and security series in this community is a great companion read. This article focuses on incidents, while theirs covers policy:

• • AI Privacy & Security: Rovo Adoption Should Start with Governance
    by @Denis Boisvert _Trundl_ and @Dave Rosenlund _Trundl_
  • When to Use Rovo, and When Not To
    by @Denis Boisvert _Trundl_ and @Dave Rosenlund _Trundl_ 
  • When AI Stops Helping and Starts Hiding Risk
    by @Dave Rosenlund _Trundl_
  • AI Isn’t Moving Too Fast
    by @Dave Rosenlund _Trundl_ 

Over to you

I’m genuinely interested in how others are handling this. Have you restricted Rovo access by app in a live customer environment, and did anything break? Has anyone set up effective monitoring for unusual agent activity? Have you found a way to use safe test injections to check behavior?

Prompt injection won’t be fixed with a patch. It will need to be managed, and the best practices for doing that will come from people like us sharing our experiences. Please share your thoughts below.

[Dave Rosenlund _Trundl_]

This work, @Martin Runge You were very thorough, and you beat me to it 👍

[Thorsten Letschert _Decadis AG_]

Great summary, @Martin Runge!