RovoBlast: Prompt Injection in Atlassian Rovo Exposes Enterprise Data

Atlassian Rovo is the company’s enterprise AI platform, positioned as a unified research and knowledge-management agent across Jira, Confluence, and the broader suite of tools a large organisation typically runs. Its ResearchAgent feature autonomously queries across 50+ connected platforms to answer questions and compile information. That breadth of access is the feature. It is also what makes a prompt injection vulnerability in Rovo significantly more dangerous than the same class of bug in a narrower AI tool.

Varonis researchers disclosed the attack — which they named RovoBlast — at DEF CON 34 in August 2026. The vulnerability is as direct as prompt injection gets.

The Injection Mechanism

Rovo Chat’s interface accepts a URL parameter named rovoChatPrompt that pre-fills the chat window with whatever text the parameter contains. The intended use is presumably deep-linking into Rovo with a pre-loaded context or question. The vulnerability is that this parameter accepts attacker-controlled text and Rovo acts on it as if the signed-in user typed it themselves.

An attacker constructs a URL of the form:

https://[tenant].atlassian.net/rovo/chat?rovoChatPrompt=[attacker-prompt]

The attacker-prompt instructs Rovo’s ResearchAgent to search for specific sensitive content and send the results to an external URL the attacker controls. The attack requires one condition: the victim must be signed into Atlassian when they open the link.

The delivery method is standard phishing infrastructure. A link is embedded in a calendar invite, sent via Slack, placed in a phishing email, or posted in a Confluence comment. The victim clicks. Rovo executes the attacker’s instructions. The victim’s browser may show a brief flash of the Rovo interface before or during the exfiltration. There is no malware, no credential theft, and no exploit code. The entire attack is a misuse of intended Rovo functionality.

What the ResearchAgent Can Reach

The scope of potential exfiltration reflects Rovo’s positioning as a cross-platform enterprise research tool. The ResearchAgent’s integrations in a typical enterprise Atlassian deployment include Jira issues across all projects the user has read access to, Confluence pages and spaces, M365 email and SharePoint, Slack channels and direct messages, and Google Workspace. Varonis researchers demonstrated the ResearchAgent autonomously querying across all of these from a single injected prompt, assembling results, and exfiltrating them to an attacker-controlled endpoint.

In practice this means an attacker could retrieve: current security incident tickets, API keys embedded in Confluence runbooks, executive communications about unreleased product plans, or any other information a senior employee with broad Atlassian access would encounter in their work. The ResearchAgent’s autonomy means it continues working through the query even as the victim navigates away, limited only by Rovo’s execution timeout.

A Second Vector: File Upload Injection

Separately, PromptArmor published findings on August 5, 2026 documenting a file-upload injection path. A malicious document uploaded to Confluence or attached to a Jira ticket can embed a prompt that triggers when Rovo’s ResearchAgent processes the file as part of a user’s search. This indirect injection path does not require the victim to click any link — it activates whenever a Rovo user queries content that includes the poisoned document.

The file-upload vector broadens the attack surface substantially. In an organisation where Rovo is deployed, any untrusted document ingested into Confluence or Jira becomes a potential injection point against any future user who queries relevant content.

Atlassian’s Response

Atlassian patched the rovoChatPrompt URL injection server-side on July 8, 2026, before the DEF CON disclosure. The patch validates and strips attacker-controlled content from the parameter before Rovo processes it. The PromptArmor file-upload finding was reported through coordinated disclosure; Atlassian’s response timeline for that vector was not confirmed at time of publication.

What to Do

Organisations running Atlassian Rovo should take three steps. First, confirm the July 8 patch is applied — server-side patches for Atlassian Cloud are automatic, but verify your tenant is current. Second, audit Rovo’s connected integrations and restrict what the ResearchAgent can access. Rovo does not need access to every Jira project and every Slack channel in the organisation; scoping permissions to what users actually need reduces the blast radius of any future injection. Third, check Rovo activity logs for anomalous queries, particularly any that include external URL targets or were initiated by unusual prompts.

The underlying issue will not be fully solved by patching a single parameter. Prompt injection is a structural property of how large language models process input — any future feature that accepts user-controlled or externally-sourced text as context for an LLM with broad data access creates a variant of the same attack surface. Rovo’s architecture, as an autonomous research agent connected to sensitive enterprise data, makes that surface particularly consequential.