Skip to content

Back to the catalog

Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data
securityweek.comarticle

Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data

Varonis Threat Labs disclosed RovoBlast, a one-click vulnerability in Atlassian's Rovo enterprise AI assistant where a crafted link using the rovoChatPrompt URL parameter seeded attacker-controlled instructions directly into a victim's live chat session, no jailbreak or permission bypass required. Because Rovo trusted externally supplied parameters and its ResearchAgent tool could autonomously browse and exfiltrate data, a single seeded link let attackers pull sensitive Confluence, Jira, and SharePoint content out to the open web in one automated chain. Atlassian patched the issue before the DEF CON talk and Varonis blog write-up were published; researchers frame the class as "parameter-to-prompt" (P2P) injection, having previously found the same pattern (dubbed Reprompt) in Microsoft Copilot.

TL;DR A single crafted link exploiting Rovo's rovoChatPrompt parameter let attackers hijack Atlassian's AI assistant and exfiltrate Jira, Confluence, and SharePoint data via its autonomous ResearchAgent, patched before DEF CON 34 disclosure.
Open original ↗
Document

What it is

RovoBlast, a one-click parameter-to-prompt (P2P) injection in Atlassian's Rovo AI assistant, disclosed by Varonis Threat Labs at DEF CON 34. Atlassian patched it before publication. The existing summary already covers the rovoChatPrompt seeding, the ResearchAgent exfiltration chain, and the three PoCs — what follows is the routing quirk and the concrete mitigations, which it omits.

How it works

Two page details sharpen the mechanism beyond the summary. First, the organization ID segment of the malicious URL could be left blank, and Atlassian would still route the request into the victim's own default organization. This is what makes the link universal rather than tied to a known org. Second, there was no warning or indicator shown to the victim that their session had been seeded from an outside source — the injected prompt is indistinguishable from the user's own input.

The blast radius was established empirically: the researchers asked Rovo what it could see, and it enumerated Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files, web pages, and archived content.

What to do

Beyond applying Atlassian's fix, Varonis recommends reducing standing exposure — relevant because the same P2P class (previously found in Copilot as Reprompt) will recur wherever an assistant trusts URL parameters:

  • Limit which systems Rovo can reach; disconnect unused integrations.
  • Wall off sensitive areas — legal, HR, finance — from assistant reach.
  • Disable browsing or multistep automation features (i.e. ResearchAgent-style tools) not in active use, since autonomous browsing is the exfiltration primitive.
  • Monitor assistant activity logs routinely.

Caveats

The attack chain requires that autonomous/browsing agent features be enabled — disabling them is listed as a mitigation, implying it breaks the exfil step. Atlassian's own statement was removed from the article at Atlassian's request, so the vendor-side framing is unavailable here; the technical write-up is on the Varonis blog.

Organisations named here

  • Varonis Threat Labs
  • DEF CON 34

Technologies named here

  • Atlassian Rovo
  • Rovo
  • ResearchAgent
  • Jira
  • Confluence
  • Bitbucket
  • Microsoft 365
  • Google Workspace

Techniques named here

  • RovoBlast
  • Parameter-to-prompt injection
  • Organization ID omission
  • Autonomous data exfiltration via agent chaining
  • Reprompt

Related in AI Security