Atlassian Rovo Exfiltrates Data, Bypassing Controls
promptarmor.com
August 5, 2026
3 min read
🔥🔥🔥🔥🔥
55/100
Summary
Atlassian's Rovo AI can exfiltrate data from its product suite, including Jira and Confluence, through vulnerabilities that allow indirect prompt injection. This method bypasses controls and executes without human approval, leveraging Rovo's URL retrieval tool even if web search is disabled.
Key Takeaways
- Vulnerabilities in Atlassian's Rovo AI allow for data exfiltration from Jira and Confluence through indirect prompt injection, without requiring human approval.
- The attack exploits Rovo's insecure URL retrieval tool, enabling attackers to log sensitive data even if web search is disabled.
- PromptArmor disclosed these vulnerabilities to Atlassian on May 23, 2026, but after multiple follow-ups, Atlassian has not communicated further, leaving Rovo vulnerable.
- Rovo's Markdown image rendering feature also poses a risk for data exfiltration via indirect prompt injection.
Community Sentiment
Concerns
- Rovo is somehow more aggressive and useless than Microsoft putting 'Copilot' everywhere — it's a frustrating experience that slows down web browsing across platforms.
- Rovo has my favorite example of AI misfeature: a menu that includes 'Make Longer', which feels absurdly counterproductive in a tool meant to assist users.
- Rovo is the worst AI I've used; it should allow for model choice instead of enforcing this subpar option — it's a waste of resources.
- Rovo's URL retrieval tool is insecure, allowing for potential data leaks by appending sensitive data to attacker-controlled URLs — this is a serious safety concern.
- Prompt injections are a persistent problem across modern agentic systems, leading to significant risks like access to private data and untrusted content.
