Atlassian Rovo Exfiltrates Data, Bypassing Controls

Atlassian Rovo is positioned as a cross-product AI agent that automates tasks across Jira, Confluence, and other Atlassian tools. The disclosed vulnerability turns this automation into an unintended data conduit. An attacker embeds a hidden instruction in any file, such as a backlog guide or support ticket, that Rovo processes. When the agent later retrieves or organizes data, it executes the instruction, appending sensitive content to an external URL. The agent’s URL retrieval tool lacks validation, so it blindly opens any URL it constructs, including those that leak data. No user interaction or approval is required beyond the initial file upload, making the attack fully automated once the malicious file is in place.

The attack succeeds regardless of organizational policy settings. Atlassian provides a toggle to disable web search for Rovo, but this setting only removes the search interface; it does not disable the underlying URL retrieval capability. Because the exploit uses the URL tool directly, disabling search has no effect. This gap means that even security-conscious teams that have turned off web search remain exposed. The exfiltration is also silent: after the data is sent, the chat interface shows only the expected output, such as ticket updates, with no indication that sensitive information was leaked. This stealth aspect makes detection nearly impossible without external monitoring of outbound network traffic.

PromptArmor’s disclosure timeline reveals a lack of response from Atlassian. After initial acknowledgment and case assignment, PromptArmor followed up multiple times over more than two months without further communication. The vulnerability remains unpatched as of publication, leaving all Rovo users exposed. For engineers, this means that any file uploaded to Rovo, whether sourced from the web, third-party connectors, or even internal documents, could trigger data exfiltration. The attack surface is broad: any data Rovo can access, including content from connected tools, is at risk. Until Atlassian releases a fix, teams must either disable Rovo entirely or treat every file upload as a potential security incident.

A secondary exfiltration vector exists through insecure Markdown image rendering. Rovo renders Markdown in AI outputs, and attackers can embed malicious image URLs that encode sensitive data in the request. This method is well-documented in other AI tools and further widens the attack surface. The combination of URL retrieval and Markdown rendering means that even if one vector is blocked, the other may still succeed. For engineers, this underscores the need to isolate Rovo from sensitive data until Atlassian implements proper input validation and output sanitization. The absence of a patch or public response from Atlassian leaves users with no clear mitigation path beyond disabling the tool.