Security researchers have demonstrated that Atlassian’s Rovo AI assistant can be manipulated through indirect prompt injection to exfiltrate sensitive Jira and Confluence data to servers controlled by attackers. Two independent security firms uncovered the issue using different techniques, underscoring that the underlying weakness is not tied to a single exploitation method.
The attack works by planting attacker-controlled instructions inside content that Rovo processes as part of its normal operation. Because Rovo can access whatever Jira and Confluence data a signed-in user is authorized to see, a successful injection lets the assistant gather that data on the attacker’s behalf and then transmit it outside the organization’s environment, effectively turning a legitimate productivity feature into a covert exfiltration channel.
Two Separate Discovery Paths
AI security firm PromptArmor identified one route by hiding malicious instructions inside content that Rovo ingests, including material introduced through an uploaded file. When Rovo processed that content, it followed the embedded instructions rather than treating them as untrusted input, a hallmark failure mode of large language model systems that lack robust separation between data and commands.
A second, independently discovered path was found by a different security firm using its own approach, though details of that specific technique were not fully disclosed. Notably, of the two confirmed attack routes, only one has been verified as closed following remediation. The status of the other remains unresolved based on available reporting.
Why This Matters
Indirect prompt injection continues to be one of the most persistent classes of vulnerabilities in AI assistants that are integrated into enterprise SaaS platforms. Because these assistants often inherit the access rights of the signed-in user, a successful injection can expose the same sensitive tickets, documents, and internal discussions that user is entitled to view, without requiring the attacker to compromise credentials directly.
Organizations using Rovo within Jira or Confluence should review Atlassian’s guidance on data handling for AI features, monitor for unusual outbound data flows, and treat any user-supplied or externally sourced content processed by AI assistants as untrusted input until vendors confirm comprehensive mitigations are in place across all known attack paths.