Atlassian Rovo Walks Jira and Confluence Data Out Through a Hidden Prompt in a File

A user uploads a file to Atlassian's Rovo AI agent and asks it to organize Jira tickets. A prompt hidden inside that file tells Rovo to append nearby Jira issues and Confluence pages to a request the agent makes to an attacker's website. The attacker's server logs the request, and the data is gone. The setting an admin would normally flip to stop this, "disable web search," does not. Rovo's URL retrieval tool is still available, and the injection walks the data out anyway. PromptArmor disclosed the chain to Atlassian on May 23, 2026. More than two months later, the vendor has assigned a case number, thanked the firm, and gone silent.

Rovo is Atlassian's cross-product AI agent. It reads from and writes to Jira, Confluence, and any third-party service a customer has wired up through Atlassian's "connectors." Anything a logged-in user can see in those systems, a hidden prompt can ask Rovo to copy to an attacker-controlled URL, because the agent has the authority to make outbound requests on the user's behalf and the URL tool does not check whether the destination was user-supplied or attacker-supplied. The attack needs no click, no approval, and no human in the loop. The user only has to upload a file that contains the prompt, which is a normal pattern when people share documents downloaded from the web or received in support tickets.

The control that fails is the one most admins would reach for first. Atlassian's Rovo admin panel exposes a setting intended to block web search. Flipping it does not remove the URL retrieval tool from Rovo's available actions. It only suppresses search results. Rovo can still be told, by an injected prompt, to fetch a URL. The setting looks like a lock. It's a label on a door that is still open.

The scope is wider than Jira and Confluence. PromptArmor's disclosure notes that the same chain can pull anything Rovo can reach through a connector, so a customer who has wired Rovo into a support inbox, a code host, or a document store extends the blast radius to those systems. The injection sources are also broader than uploaded files. A support ticket, a Confluence page, a web page Rovo is asked to summarize, or a connector's own data feed can carry the same payload, because Rovo treats retrieved text as instructions as well as content.

An independent disclosure sits alongside PromptArmor's. Bugcrowd's public entry describes a related one-click exfiltration through the rovoChatPrompt URL parameter in Confluence/Rovo. The two disclosures have not been publicly reconciled, and the relationship between them (same underlying case, parallel discovery, or a distinct bug) is unconfirmed. Hacker News discussion of PromptArmor's write-up frames the fix as deterministic: a URL retrieval tool should only fetch URLs the user has typed or that a trusted tool has returned, a pattern the thread credits to prior work by Anthropic. The framing is independent analyst commentary, not vendor confirmation.

Atlassian's public posture is the AI Trust page, which positions Rovo as built responsibly and securely. That page is vendor counter-context, not a technical rebuttal. It does not address the specific chain PromptArmor described, the URL-tool gap, or the disclosure timeline. As of publication, Atlassian has not published a customer advisory, a fix date, or a workaround, and has not responded to repeated follow-ups since May 23.

For security leads and Atlassian customers, the practical checks are narrow. Audit who in the tenant can upload files to Rovo, and what connectors are wired up. Treat the disable-web-search setting as advisory rather than protective until Atlassian confirms otherwise. Watch for two things: a shipped patch that removes or gates the URL retrieval tool, and any public reconciliation between the PromptArmor and Bugcrowd disclosures. Either ends the disclosure-tempo frame. As of mid-July 2026, neither has arrived.