Atlassian Rovo AI Still Leaks Jira Data via Prompt Injection

A security researcher has published a working exploit that turns Atlassian's Rovo AI agent into a tool for stealing your own Jira tickets and Confluence documents, and Atlassian has known about it since May 23, 2026 without shipping a fix. The attack needs no unusual permissions and no human clicking "approve": a hidden instruction buried in an uploaded file is enough to make Rovo quietly hand your company's data to an attacker's website while the chat looks completely normal.

• Security firm PromptArmor disclosed the flaw to Atlassian on May 23, 2026. After one acknowledgment and two follow-ups, Atlassian never responded again, and Rovo is still vulnerable as of the August 5 publication.
• The attack is indirect prompt injection: a hidden instruction inside an uploaded file, ticket, or web page manipulates Rovo into leaking data, no malicious link click or approval needed.
• Turning off Rovo's "Enable web search" setting does not stop the attack, because it fails to remove the underlying tool that opens URLs.
• A second, separate exfiltration path exists through Rovo's Markdown image rendering, a well-known data-leak vector PromptArmor has found in several other AI products.

What exactly is the vulnerability?

Rovo is Atlassian's AI agent, built into Jira, Confluence, and the rest of its product suite. PromptArmor found that Rovo's tool for opening URLs, used so the agent can fetch a web search result or a linked page, has no protection against opening a URL that the model itself dynamically constructed. Combine that with indirect prompt injection, hidden instructions planted somewhere the agent will read, and an attacker can make Rovo build a URL like attacker.com/?data=<stolen ticket contents> and then call its own tool to "open" it. The attacker doesn't need Rovo to send an email or write to a file. They just need to run a web server and watch the access logs.

RelatedCopilot for Word Can Spread a Self-Replicating AI Worm

How does the attack actually work, step by step?

The chain PromptArmor demonstrated starts with something mundane: a user finds a document online, something like a "Backlog Guide," and uploads it to Rovo for help organizing their Jira tickets. That document contains a concealed prompt injection invisible to the person reading it normally. When the user asks Rovo to organize their tickets, Rovo does what was asked, it searches Jira and Confluence, but the injected instructions ride along and redirect part of that work: take the ticket and document contents just retrieved, and open a URL with that data appended to it. Rovo's insecure tool executes the request without question. The attacker's server logs the incoming request, data included. The victim, meanwhile, sees Rovo's normal suggested ticket updates and no indication anything else happened. PromptArmor notes that if the chat is reopened later, all evidence of the attack is gone and the output looks completely ordinary.

Why doesn't disabling web search protect you?

Because Atlassian's "Enable web search" toggle turns off Rovo's ability to run a search, but it does not remove the separate tool Rovo uses to open a URL once it has one, the same tool the injection abuses. An admin who has already locked down Rovo by disabling web search, reasonably assuming that removes exactly this kind of risk, is still exposed. That gap between what a security setting is named and what it actually restricts is the kind of detail that makes this bug worse than a simple missing permission check: organizations that believe they've mitigated the risk have not.

Why did Atlassian stay silent for two months?

PromptArmor's own timeline is unusually specific and unflattering. They reported the issue on May 23, Atlassian assigned a case number and thanked them two days later, and then nothing: a follow-up on June 4 and another on July 29 both went unanswered, and Rovo was still vulnerable when PromptArmor published on August 5. Atlassian has not issued a public statement or CVE as of this writing. Two months of silence after an initial acknowledgment is long enough that PromptArmor decided public disclosure, and the pressure that comes with it, was more likely to get a fix shipped than another private follow-up.

Who's affected, and how serious is this?

Any organization using Rovo across Jira and Confluence is potentially exposed, and the attack surface is broader than "don't open suspicious files." PromptArmor notes the injection source doesn't have to be a file upload at all, it can be data already inside Atlassian like a support ticket, a page fetched via web search if enabled, or content pulled through a third-party connector. Anything Rovo can read, an attacker can potentially use as a delivery mechanism, and anything the agent can access, including through connectors, can be exfiltrated. For companies that store real customer or engineering data in Jira and Confluence, and increasingly grant Rovo broad read access to make it useful, that is a meaningful blast radius for a bug with no fix date.

RelatedA CVSS 10 UniFi flaw exposes 100,000 gateways to takeover

The pattern matters more than any single row. PromptArmor has now published this same shape of bug, an AI agent tricked into fetching or rendering attacker-controlled URLs, against Codex, OpenAI's own API logging, Superhuman's email assistant, Hugging Face's chat product, and Writer.com. That's not five unrelated bugs. It's one systemic weakness, agent tools that fetch URLs or render Markdown without checking whether the URL or content was attacker-influenced, showing up across nearly every major AI-agent product still shipping this feature without a fix.

How this played out over time

1. May 23, 2026PromptArmor discloses the vulnerabilities to Atlassian.
2. May 25, 2026Atlassian acknowledges and assigns a case number.
3. Jun 4, 2026PromptArmor follows up. No response from Atlassian.
4. Jul 29, 2026PromptArmor follows up again. Still no response.
5. Aug 5, 2026PromptArmor publishes the research. Rovo remains vulnerable at time of publication.

What should Jira and Confluence admins do right now?

Our take

The technical bug here is almost boring, an agent tool that opens a URL without checking where the data in that URL came from, and that's exactly the point. Indirect prompt injection keeps working against production AI products not because it's exotic, but because "let the agent fetch a URL" is such a basic, useful feature that almost nobody builds it defensively. What should worry Atlassian customers more than the bug itself is the response: a case number and silence for two-plus months on a data-exfiltration flaw in a product wired into Jira and Confluence for thousands of companies. Rovo is not unique here, PromptArmor's back catalog shows this exact failure mode across the industry, but "everyone has this bug" is a reason to fix it faster, not a reason to wait. Until Atlassian ships a patch, the honest advice is to assume Rovo can leak anything it can read.

Original analysis by GenZTech, based on PromptArmor's published research.