Atlassian Rovo AI Vulnerability Lets Attackers Steal Enterprise Data With a Single Click

RovoBlast is a recently disclosed vulnerability affecting Atlassian’s Rovo AI assistant that allows attackers to expose sensitive enterprise data through a single malicious link.

According to Varonis Threat Labs, the vulnerability exploits Rovo’s handling of URL-supplied prompts, enabling attackers to inject malicious instructions into an authenticated user’s AI session.

The attack does not require traditional permission bypasses, jailbreaks, or exploits of the victim’s account. Instead, it exploits a parameter-to-prompt (P2P) weakness: Rovo treats text embedded in a URL as a pre-filled chat instruction within a user’s trusted session.

Atlassian Rovo AI Vulnerability

Researchers named the issue RovoBlast due to the potentially extensive impact created by Rovo’s integrations and agent capabilities. A crafted link using the `rovoChatPrompt` parameter could open Rovo Chat with attacker-provided instructions preloaded. An example link follows this pattern:

`https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<prompt>`

When a logged-in employee clicks the link, Rovo may interpret the supplied content as an instruction rather than untrusted external input.

Varonis indicated that this creates a low-friction pathway for attackers, allowing the assistant to search, summarize, and possibly move organizational data without obvious warnings or confirmation prompts.

Rovo is designed to serve as an AI layer across Atlassian products, including Jira, Confluence, and Bitbucket. It also integrates with external enterprise platforms, including Slack, Microsoft 365, Google Workspace, databases, uploaded files, archives, and web resources.

While this access model is beneficial for productivity, it poses significant risks when attacker-controlled content enters a privileged AI workflow.

Since Rovo operates under the identity and permissions of a legitimate user, actions generated by a malicious prompt may appear to be normal AI-assisted research.

Varonis identified Rovo’s ResearchAgent capability as particularly concerning. This tool can perform multi-step research and navigate websites, potentially creating a chain in which the assistant retrieves internal data, summarizes it, and sends it to an external destination.

Researchers found that a single prompt was often sufficient to trigger the retrieval of sensitive data. Unlike some prompt-injection attacks, the RovoBlast proof of concept did not require repeated prompts or elaborate jailbreak techniques to evade safeguards. This makes suspicious activity harder for defenders to distinguish from routine work.

Organizations should minimize Rovo’s data access by disconnecting unused integrations and excluding highly sensitive repositories such as legal, HR, finance, and incident-response systems.

Security teams should also limit unnecessary browsing, autonomous agent, and multi-step automation features. Monitoring is equally important; teams should review AI assistant logs, alert on unusual agent behavior, and routinely test whether externally supplied prompts from URLs, documents, emails, or connected services can influence internal AI workflows.

RovoBlast highlights a broader security pattern: when an AI assistant has access to private data, processes untrusted content, and can communicate externally, a seemingly harmless click can lead to data exfiltration.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world