Security researchers at Varonis Threat Labs disclosed a one-click vulnerability in Rovo, Atlassian’s enterprise AI assistant, that allowed attackers to inject instructions directly into a victim’s live AI session without any jailbreak or permission bypass. The flaw, dubbed RovoBlast, was presented at DEF CON 34 and has since been fixed by Atlassian.
Rovo operates as an AI layer across Jira, Confluence, Bitbucket, and connected third-party tools including Slack, Microsoft 365, and Google Workspace. It also includes autonomous agent capabilities that can complete multi-step tasks without further user input, a feature central to how the attack unfolded.
How the exploit worked
The attack abused a URL parameter called rovoChatPrompt, which pre-fills content into Rovo’s chat window. Varonis calls this class of attack parameter-to-prompt (P2P) injection, a technique the firm previously identified in Microsoft Copilot under the name Reprompt. Researchers found that the organization ID portion of the URL could be left blank, and Atlassian would still route the request into the victim’s default organization with no warning that the session had been seeded externally.
To measure the potential impact, researchers simply asked Rovo what data it could access. The assistant listed Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files, web pages, and archived content. The actual data leakage came through ResearchAgent, a built-in Rovo tool capable of autonomous multi-source web research and arbitrary site navigation. Once an attacker’s prompt was seeded via the malicious link, that same capability let Rovo retrieve internal data and push it to the open web in a single automated chain.
Varonis demonstrated three proof-of-concept scenarios exfiltrating Confluence pages, Jira tickets, and SharePoint content containing personal data. A single seeded link was generally sufficient to trigger the leak, with no chaining of requests or additional bypass steps required.
Response and mitigation
Varonis disclosed RovoBlast to Atlassian, which patched the issue before publication. Atlassian said the vulnerability requires a user with access to a customer’s Atlassian instance to supply untrusted content containing a prompt injection, and noted this attack class affects AI systems industry-wide. The company said it is working with customers on protective controls and continuing to invest in additional solutions.
Varonis recommends organizations limit which systems Rovo can reach, disconnect unused integrations, wall off sensitive areas such as legal, HR, and finance, disable browsing or multistep automation features not in active use, and monitor assistant activity logs routinely.