Atlassian's Rovo AI assistant contains a prompt injection vulnerability that allows attackers to extract sensitive Jira and Confluence data accessible to authenticated users. Security researchers at PromptArmor discovered the flaw by embedding malicious instructions within content that Rovo processes, compelling the assistant to retrieve confidential information and transmit it to attacker-controlled servers.
The vulnerability exploits Rovo's design as a generalist assistant integrated with Atlassian's enterprise collaboration tools. When users interact with Rovo, the system accesses data permissions tied to the authenticated session. Attackers can inject instructions through multiple vectors, including uploaded files or embedded content within Jira tickets and Confluence pages. Rovo executes these injected commands without distinguishing legitimate user requests from attacker directives.
PromptArmor and at least one additional security firm identified the same behavior through different attack paths. This suggests the vulnerability has multiple exploitation routes. Atlassian has confirmed closure of only one attack vector, leaving the broader prompt injection issue partially unresolved.
The risk extends to any organization using Rovo with active Jira or Confluence deployments. Attackers can harvest project plans, roadmaps, source code references, customer lists, internal communications, and other sensitive data. The threat multiplies when users with elevated permissions interact with compromised content. A single malicious file or wiki page can compromise all data accessible to that user's account.
Prompt injection attacks represent a growing attack surface for AI-integrated enterprise tools. Unlike traditional code injection, these attacks exploit the natural language processing model's inability to distinguish system boundaries. Rovo processes instructions semantically rather than syntactically, making traditional input validation ineffective.
Organizations should restrict Rovo's data access permissions to the minimum required for legitimate operations. Users should avoid uploading untrusted files or accessing R