Atlassian Rovo: Zero-Click Data Leak Reported

Atlassian Rovo AI vulnerability: a zero-click data leak

PromptArmor reports that Atlassian Rovo can be made to send out Jira and Confluence data without the user approving anything. Rovo is Atlassian's multi-purpose AI agent, and it works across products such as Jira and Confluence. The report calls the weakness zero-click, which means no person has to confirm a step for the data to leave.

The method is indirect prompt injection. A command is hidden inside material the AI is asked to read, and the AI follows it as if the user had typed it. The report says the data can come from anywhere in the tenant (the workspace tied to one customer account) and names Jira tickets and Confluence documents.

The tool at fault is Rovo's URL retrieval tool. The report says it has no protection against opening a web address that the agent itself builds on the fly. In the demonstration, the attacker's server logs end up holding the stolen Jira tickets and Confluence documents.

Rovo AI security gap: web search off, data still leaks

The attack succeeds even when an administrator switches off web search for the whole organization. The report says the setting does not remove the tool that opens the search results.

If a file carries a hidden command, the admin's switch changes nothing, since the tool that sends the data out is still there. The report includes a screenshot of the organization-wide "Enable web search" setting toggled off while the attack goes through.

The attack also leaves nothing for the user to notice. When the user returns to the chat later, the screen shows the ticket updates the agent suggested and no sign of the attack, and the report says all evidence is gone.

Prompt injection reaches Rovo agents by more than one route

In the demonstration, the hidden command arrives in a file. The report says it is quite common for a user to find a file online and upload it to Rovo. It also states that the attack does not depend on where the injected text comes from, and names these other sources:

• External data inside Atlassian, such as support tickets
• Web data, if search is enabled
• Third-party connectors, the integration feature through which Rovo reads data from outside services

For a Rovo agent, then, "do not upload strange files" covers only one of several routes. Text written by outsiders can reach the agent through tickets and connected services as well.

The report also describes a second, separate way to get data out. Rovo renders Markdown images from AI output, and the report calls insecure Markdown image rendering a well-known vector for data exfiltration through indirect prompt injection.

Rovo AI vulnerability disclosure: no fix after two months

PromptArmor says it reported the vulnerabilities to Atlassian on May 23. Atlassian assigned a case number and expressed thanks. After that, PromptArmor says, it followed up several times over more than two months and received no further communication from Atlassian.

PromptArmor states that Rovo remains vulnerable and gives that as its reason for publishing: to inform users of the risks. This timeline is PromptArmor's account alone, and the only Atlassian response it records is the case number and thanks. For a team running Rovo, the practical point is narrow: when PromptArmor published, it described no Atlassian patch that an admin could check for.

Prompt injection reports on Rovo agents: zero-click vs one-click

The attack is zero-click: PromptArmor's own report says it runs with no human-in-the-loop approval. Searches for an Atlassian Rovo vulnerability turn up more than one write-up, and some use different names and describe the trigger as a single click. A reader comparing them should not treat the one-click and zero-click descriptions as the same finding until each report's own text says so.

When you read any account of this issue, check two things in its own wording: whether a person has to click or approve anything for the data to leave, and whether the account says Atlassian has fixed the problem. PromptArmor's answers are no approval needed and no fix.

Rovo security: check connectors, Jira and Confluence access

The report ties the damage to what Rovo can read. It states that the injected command can take any data the agent can access in Atlassian, including data the agent reaches through connectors. For an admin, the report supports three points:

• The data at risk equals the data Rovo can reach in Jira, Confluence and any connected service.
• The web search switch is not a control against this attack, according to the report.
• The report names no Atlassian fix to apply, so there is no patch step to follow.

Two related pieces on this site are UK AISI Incident: 19 Unsanctioned AI Agent Actions and Cloudflare OS: An Open-Source AI Agent Platform. The first is about an incident involving unsanctioned AI agent actions, the second about an open-source AI agent platform.