Atlassian’s enterprise AI assistant, Rovo, has been found vulnerable to a prompt injection attack, dubbed “RovoBlast,” which could allow attackers to exfiltrate sensitive data from connected services like Jira, Confluence, and SharePoint. This flaw was addressed by Atlassian on July 8, 2026, following responsible disclosure.
Rovo is designed to search, summarize, and perform actions across various platforms, leveraging organizational context to enhance productivity. However, this broad access also introduces significant security risks when untrusted content is processed as legitimate instructions.
The RovoBlast attack exploited a URL parameter named rovoChatPrompt, which could pre-fill Rovo Chat with a prompt when a signed-in user clicked a specially crafted link. This parameter-to-prompt injection (P2P injection) allowed attackers to execute commands within the victim’s authenticated session, effectively granting them the same access as the user.
Notably, this attack did not require credential theft or permission bypasses. A victim merely needed to click a malicious link while signed into Atlassian. Rovo would then search data sources accessible to the user and summarize the results, potentially exposing confidential information such as internal Jira tickets, Confluence pages, API keys, project plans, customer records, and incident-response documentation.
Rovo’s autonomous capabilities, like its ResearchAgent, can perform multi-step research and browsing tasks. In an unsafe prompt-injection scenario, these features may enable the AI assistant to retrieve internal content, transform it, and communicate it to an external destination with minimal user interaction.
This incident underscores a broader security challenge with enterprise AI assistants, which often combine access to private data, exposure to untrusted content, and the ability to use external tools or websites. Such combinations can turn ordinary links, documents, comments, or connected applications into entry points for instruction injection.
Organizations are advised to treat AI assistants as privileged access layers rather than simple chat interfaces. Reviewing Rovo permissions, disconnecting unused connectors, and restricting access to highly sensitive repositories are recommended steps. Limiting agentic browsing and automation capabilities where unnecessary can also mitigate risks.
Monitoring AI activity logs, investigating unusual agent runs, and testing whether external inputs can influence AI behavior are crucial. User awareness training should cover malicious links and AI-enabled phishing scenarios to enhance security posture.
The RovoBlast incident highlights that enterprise AI risk extends beyond model behavior to trust boundaries. When an AI assistant can read sensitive data, impersonate legitimate users, and interact with external services, a single misclassified input can lead to silent data exposure.
