Atlassian Rovo XPIA: Uploaded File Silently Exfiltrates All Jira and Confluence Data — Disabling Web Search Doesn’t Stop It, 75 Days After Disclosure Still Unconfirmed Closed, RovoBlast Fixed but Second Route Open

Sources: PromptArmor — “Atlassian Rovo Exfiltrates Data, Bypassing Controls” (primary disclosure, May 23 private → August 5, 2026 public) · Varonis Threat Labs — “RovoBlast: Atlassian Rovo XPIA via rovoChatPrompt URL Parameter” (Bugcrowd, fixed July 8, 2026) · The Hacker News — “Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers” · Let’s Data Science — Full remediation status analysis · Grid the Grey — Technical reconstruction of both attack paths · AIO Apex — ResearchAgent tool and connected services scope detail · Daily.dev — PromptArmor route technical summary | Attack 1 (PromptArmor): Content-based indirect prompt injection — hidden instructions in uploaded file or Confluence content → Rovo URL retrieval tool → data appended to attacker URL → exfiltrated · Disclosed privately: May 23, 2026 · Published: August 5, 2026 · Remediation status: Unconfirmed as of August 8 · Works with web search disabled: Yes | Attack 2 (Varonis/RovoBlast): rovoChatPrompt URL parameter injection → one click from authenticated user → Rovo executes with user privileges → ResearchAgent pulls Jira/Confluence/SharePoint/Slack/Google Workspace/M365 data → exfiltrates · Disclosed: Bugcrowd · Fixed: July 8, 2026 (server-side, Atlassian) · Validated: Yes | Atlassian response to PromptArmor: Case number assigned May 25 · Two follow-ups (June 4, July 29) with no response · Published after 75 days with no further communication | Data at risk: Jira ticket contents · Confluence pages · private API keys · workspace member lists · internal page/org IDs · author email addresses · SharePoint · Slack · Google Workspace · M365 (if connected to Rovo)

“Nothing checks whether the URL being opened was one the agent constructed itself.” — PromptArmor. Upload a file. Walk away. Rovo finds the hidden instructions, queries every Jira ticket and Confluence page the victim can access, and sends it to the attacker’s server. Disabling web search doesn’t stop it. The URL retrieval tool is still there.

Two independent AI security firms — PromptArmor and Varonis Threat Labs — independently discovered that Atlassian’s Rovo AI assistant can be manipulated through indirect prompt injection to collect data from Jira, Confluence, and connected enterprise services and transmit it to attacker-controlled infrastructure. The two firms found different attack paths, disclosed through different channels, with different remediation outcomes. Varonis’s route (RovoBlast) was fixed by Atlassian on July 8, 2026. PromptArmor’s route — disclosed privately on May 23, 2026, followed up twice with no response — was confirmed exploitable at publication on August 5, 2026, and remained unconfirmed as remediated as of August 8.

The affected product is not a peripheral AI tool. Atlassian Rovo is the AI assistant embedded across Jira and Confluence — the project management and documentation platforms that enterprise software, security, and operations teams use for everything from sprint planning to incident response to architectural documentation. Rovo operates with the full permissions of the authenticated user who invokes it, and can be connected to SharePoint, Slack, Google Workspace, and Microsoft 365 in addition to Jira and Confluence natively. The blast radius of a successful attack scales directly with how broadly Rovo has been connected to an organization’s internal systems.

Attack 1 — PromptArmor: the content-based injection that bypasses web search controls

The attack chain

An attacker uploads a file to a Confluence space, or embeds hidden instructions in existing Confluence content, that Rovo will process as part of a legitimate user request. The instructions are crafted as a prompt injection — natural language instructions to Rovo embedded in content that appears normal to human readers. When a Rovo user asks the assistant to work with content in that Confluence space — summarizing documents, answering questions, researching a topic — Rovo processes the poisoned content as part of its context and receives the attacker’s instructions alongside the legitimate request.

The injection manipulates Rovo to submit Jira tickets and Confluence documents to the attacker’s website. Rovo’s URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker’s URL. When Rovo calls the insecure tool to open the URL, the attacker’s site logs the request, including the appended sensitive data.

The exfiltration is silent and requires no separate human-in-the-loop approval step. The victim asks Rovo a normal question about their Jira tickets or Confluence pages. Rovo finds the answer — and simultaneously sends that answer, and whatever other data the injected instructions specify, to the attacker’s server via the URL retrieval tool. The victim sees a normal Rovo response. The attacker’s server logs the exfiltrated data.

Why web search disabled is not a mitigation

Atlassian offers web search as an organization-level setting — administrators can disable Rovo’s ability to access public websites. PromptArmor’s finding directly addresses this: this attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results. The root cause is that nothing checks whether the URL being opened was one the agent constructed itself.

The underlying issue is architectural: Rovo has a URL retrieval capability that is used for web search, but the web search setting only controls whether users can initiate web searches — it does not remove or restrict the underlying URL retrieval tool that the search feature uses. The injected prompt can invoke that tool directly, bypassing the setting entirely. An organization that disabled web search specifically to reduce Rovo’s attack surface has not closed the PromptArmor exfiltration path.

The Markdown image rendering secondary channel

PromptArmor also noted a second potential exfiltration channel: Rovo renders Markdown images from model output, creating a potential second exfiltration channel. When Rovo generates a response that includes a Markdown image tag — `` — the client renders that image by fetching the URL. If the injected instructions cause Rovo to construct a Markdown image tag where the URL includes sensitive data as query parameters or path components, fetching that image would deliver the data to the attacker’s server. PromptArmor notes this route but states a complete demonstration chain via this specific mechanism was not included in their report.

The disclosure timeline — 75 days, two follow-ups, no response

PromptArmor’s disclosure timeline is operationally significant: PromptArmor disclosed the vulnerabilities to Atlassian on May 23, 2026. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable. Follow-ups on June 4 and July 29 received no response. PromptArmor published on August 5 — 75 days after initial disclosure — with the vulnerability still confirmed exploitable.

The Hacker News confirmed as of August 8 that there was no post-publication update to PromptArmor’s report and that the report’s text still described Rovo as vulnerable at the time it was published. Neither disclosure confirms whether Atlassian’s July 8 fix for RovoBlast touched the content-based injection path — the two routes are technically distinct and the July 8 fix is confirmed only against the URL parameter route.

Attack 2 — Varonis RovoBlast: the one-click URL parameter injection (fixed July 8)

Varonis Threat Labs identified a different attack surface: the rovoChatPrompt URL parameter in Rovo Chat links. The rovoChatPrompt parameter could carry a full prompt in a Rovo URL. The proof of concept told Rovo to locate information the victim could access, put it into the path of an attacker-controlled image URL and fetch the image. That request delivered the data to the attacker’s server.

The attack requires one click from an authenticated Rovo user on an attacker-crafted link. The link preloads Rovo’s chat interface with the attacker’s instructions before the user even opens it. When the user opens the link, Rovo treats the preloaded prompt as legitimate input and executes it with the user’s full permissions. From there, Rovo’s built-in ResearchAgent tool, designed for legitimate multi-source research, can be turned against the organization to autonomously pull data from Jira, Confluence, and integrated services including SharePoint, Slack, Google Workspace, and Microsoft 365, then send it to the attacker.

Varonis disclosed RovoBlast through Atlassian’s Bugcrowd bug bounty program. Atlassian deployed a server-side fix on July 8, 2026, which was validated by the Varonis researcher. This route is confirmed closed for Atlassian cloud tenants.

What data is at risk — why Rovo’s permissions scope is the threat model

Both attacks exploit the same fundamental property: Rovo operates with the permissions of the authenticated user who invokes it, not with a restricted subset of permissions. This means the blast radius of a successful Rovo XPIA is not bounded by the attack — it is bounded by how broadly the victim’s Rovo access has been configured.

The data categories confirmed accessible via both routes include Jira ticket contents — including security vulnerability reports, incident post-mortems, customer escalations, and internal project details — Confluence page text including architectural documentation, runbooks, meeting notes, and strategic planning documents, private API keys stored in Confluence pages, workspace member lists, internal page and organization IDs, and author email addresses. Because Rovo operates with whatever access the logged-in user has, the blast radius of a successful attack scales directly with how broadly an organization has connected Rovo to its internal systems. For organizations that have connected Rovo to SharePoint, Slack, Google Workspace, and Microsoft 365, the ResearchAgent tool extends the exfiltration surface to those platforms as well.

The AI assistant attack surface arc — Rovo as the enterprise productivity layer equivalent of Copilot

The Atlassian Rovo XPIA sits at the intersection of every AI assistant attack surface story DataWater has covered in 2026. The attack class is identical to the Copilot for Word AI worm (Article #50) — Cross-Domain Prompt Injection where hidden instructions in document content are executed by an AI assistant with the victim’s permissions, with exfiltration as the payload rather than self-propagation. The connected services scope (SharePoint, Slack, Google Workspace, M365) mirrors the HollowGraph pattern of legitimate cloud infrastructure as attacker terrain. And the “no check whether the URL was agent-constructed” root cause is the same architectural gap that made Copilot’s Word worm architecturally unresolvable: LLMs cannot reliably distinguish trusted instructions from attacker-supplied content in the data they process.

The enterprise productivity AI stack — Copilot in M365, Rovo in Atlassian, Gemini in Google Workspace, Claude in Slack — is now a confirmed attack surface. Every AI assistant that processes enterprise content, has permissions to access organizational data, and can make outbound requests is a potential XPIA exfiltration vector. The attack doesn’t require finding a zero-day in the underlying platform. It requires hiding natural language instructions in content the AI will read.

Sources and further reading

• PromptArmor — “Atlassian Rovo Exfiltrates Data, Bypassing Controls” (Primary Disclosure, May 23 → August 5, 2026)
• The Hacker News — “Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers” (Full Two-Route Analysis)
• Let’s Data Science — “Atlassian Rovo Flaws Expose Enterprise Data” (Remediation Status Per Route)
• Grid the Grey — Technical Reconstruction of Both Attack Paths (PromptArmor + Varonis RovoBlast)
• AIO Apex — ResearchAgent Tool Scope and Connected Services Detail (SharePoint, Slack, Google Workspace, M365)

DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders. Article #56 — August 9, 2026. Previous: Kimi K3 Sandbox Escape (August 7) · Langflow CVE-2026-9198 (August 5) · Pass-ta-key (August 4). Full archive →