Researchers at Varonis Threat Labs disclosed “RovoBlast,” a one-click prompt-injection flaw in Atlassian’s Rovo AI assistant that lets a crafted link seed attacker instructions into a victim’s live AI session and push internal data out of the enterprise. A separate disclosure from the firm PromptArmor describes a content-borne path in which instructions hidden inside an uploaded file trigger the same kind of data collection and transmission. Atlassian deployed a server-side fix for the link vector, while the remediation status of the second path remained unconfirmed at the time of publication.
How RovoBlast Seeds Instructions Through the rovoChatPrompt Parameter
Varonis described the flaw as requiring no jailbreak and no permission bypass: Rovo treats externally supplied parameters as trusted input, according to the researchers’ presentation at DEF CON 34. A victim who clicks a crafted link carrying attacker instructions in the rovoChatPrompt URL parameter opens a live session in which those instructions are already active.
The Blank Organization ID and Silent Default-Org Routing
The flaw was compounded by lax validation of the organization identifier in the URL. Varonis found that the organization-ID portion of the link could be left blank and Atlassian would still route the request into the victim’s default organization without warning. That detail removes a potential tripwire that might otherwise have flagged the request as anomalous to a user or administrator.
ResearchAgent’s Autonomous Pull-and-Push Exfiltration Chain
The impact stage relies on Rovo’s ResearchAgent tool, which autonomously pulls internal data and pushes it out to the web in a single chain. Varonis demonstrated exfiltration of Confluence pages, Jira tickets, and SharePoint content containing personal data, and said a single seeded link was generally enough to complete the action. The disclosure follows the firm’s earlier reporting of the same parameter-to-prompt class in Microsoft Copilot, which it dubbed “Reprompt.”
PromptArmor’s Content-Borne Vector in an Uploaded File
PromptArmor described a second attack path that does not depend on a crafted link. Instructions hidden inside an uploaded file caused Rovo to gather Jira and Confluence data and send it out via a URL request with no separate approval step, the firm reported. The chain continued to work with Rovo’s web search disabled, and it produced the data leak without triggering a distinct approval prompt.
PromptArmor’s Early Report and the Unconfirmed Remediation Status
PromptArmor said it reported the issue to Atlassian in May, followed up in June and late July, and published its findings in early August. As of publication, the firm had not confirmed whether Atlassian had remediated the content-borne path, in contrast to the link vector, which the reporting researcher validated as fixed.
The P2 Bounty and the Server-Side Fix for the Link Path
Atlassian corrected the link vector with a server-side change, and the finding was rated P2 with a $6,000 bounty through the company’s Bugcrowd program. Neither disclosure carries a CVE identifier, and neither flaw appeared in the NVD or the CISA Known Exploited Vulnerabilities catalog as of early August.
The Fix Status and What Remains Open for Rovo Customers
There is no customer-side patch for the already-fixed link path, so remediation rests on Atlassian’s server-side change. For organizations running Rovo, which ships enabled by default on Standard, Premium, and Enterprise plans, the company has pointed administrators to controls for limiting which systems Rovo can reach, disconnecting unused integrations, restricting Rovo access by app and, on Enterprise plans, by group, and disabling unneeded browsing or multi-step automation.
Rovo’s Default-On Deployment and the Administration Levers Available
Because the assistant is enabled by default on the three paid plans, its reach into Jira, Confluence, Bitbucket, Slack, Microsoft 365, and Google Workspace connectors exists before most administrators configure it. Atlassian’s guidance gives teams the levers to constrain that reach, but only if those controls are actually applied.
No Exploitation Evidence and the Unfixed Content-Borne Rovo Path
Neither researcher reported evidence that either technique was used against a real organization, and the link path has been corrected. The content-borne path, with its unconfirmed remediation status, leaves a narrower but unresolved question for security teams evaluating how much of the assistant’s surface remains exposed.
What the Rovo Disclosures Signal for Enterprise AI Assistants
The paired disclosures show how far the trust boundary in enterprise AI assistants has shifted: an assistant wired across Jira, Confluence, and third-party connectors can be directed to collect and transmit data the user is permitted to see, with no separate approval step required for the malicious instruction. Because the attack needs no jailbreak and no permission escalation, it sidesteps the security controls organizations tend to lock down first. The episode also exposes the gap between the fast-moving disclosure of AI prompt-injection vectors and the slower machinery of CVEs and vulnerability catalogs, leaving defenders without a standard identifier to anchor a hunt. As assistants become default-on across enterprise productivity suites, the practical burden shifts to administrators to treat AI connector connectivity as attack surface and apply the same least-privilege review to those integrations that they would to any other.
