Two ways in, two different clocks
Atlassian's Rovo is the AI assistant now built into Jira and Confluence, able to search across tickets and pages and pull in data from connected apps on a user's behalf. In the space of a few months, two independent security researchers found two separate ways to turn that convenience into a data-exfiltration channel, and Atlassian's response to each ran on a completely different clock.
Varonis reported its technique through Bugcrowd, Atlassian's official bug bounty platform, and had a validated server-side fix within about six weeks. PromptArmor reported its technique directly to Atlassian's security team in May and was still waiting for a fix when it published its findings on 5 August 2026, ten weeks and three follow-up messages later. Neither issue has been assigned a CVE identifier as of 8 August 2026, according to reporting on the disclosures.
The one-click version Atlassian already fixed
Varonis's technique, which researchers named RovoBlast, exploited a URL parameter called rovoChatPrompt that could preload attacker-written instructions directly into a Rovo Chat session. A single click on a crafted link from an authenticated user was enough to trigger it: Rovo would locate information the victim could access, embed it inside an attacker-controlled image URL, and fetch that image, quietly delivering the data to the attacker's own server. Testing confirmed the technique could reach private Confluence API keys and data available through Jira, SharePoint and Outlook connectors.
Atlassian rated the report P2 priority, paid a $6,000 bounty, and shipped a server-side fix on 8 July 2026, which Varonis then validated as closed. That is the version of this story that worked the way vendor disclosure is supposed to work.
The version that is still open
PromptArmor's technique is an indirect prompt injection: instructions hidden inside a document, invisible to the human reader, that take effect the moment a user asks Rovo to read or search that content. Rovo follows the hidden instructions, gathers the Jira tickets and Confluence pages the signed-in user can access, appends that data to a URL, and opens the URL itself through its own retrieval tool - with no separate approval step for the human to catch or block. PromptArmor's writeup is explicit that disabling Rovo's web search option does not stop it, because that setting removes web search but leaves in place the underlying tool Rovo uses to open URLs and render the images and links it retrieves.
PromptArmor disclosed the issue to Atlassian on 23 May 2026 and received an acknowledgment with a case number two days later. It followed up again on 4 June and 29 July with no further substantive response, and published its findings on 5 August 2026 with the flaw still unresolved and no confirmed fix date from Atlassian.
What to actually check this week
The lesson here is not really about Atlassian specifically - it is about how AI agent settings work across SaaS tools generally. A toggle labeled to sound like it disables a capability may only disable one narrow feature built on top of a broader tool the agent still has full access to. Before trusting any admin setting on an AI copilot bolted onto Jira, Confluence, SharePoint or a similar platform, the actionable step is to test what the setting actually does, or have your security team attempt to reproduce a known technique like PromptArmor's against it, rather than taking the label at face value.
The second actionable step is scoping: audit which connectors any AI agent in your stack can reach, and cut default broad read access down to what each team genuinely needs, because the exposure in both Rovo cases was defined entirely by what the signed-in user's own permissions already allowed. An AI agent does not create new access - it just makes existing over-broad access much easier for an outsider to reach in bulk.
Read next: Cloudflare's New Browser Cuts AI Costs, Not Time | Three Days to Patch the AI Builder Nobody Logged
