Rovo - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rovo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 08 Aug 2026 12:09:37 +0000RovoBlast Parameter-to-Prompt Injection Vulnerability in Atlassian Rovohttps://feed.craftedsignal.io/briefs/2026-08-rovo-blast/Sat, 08 Aug 2026 12:09:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-rovo-blast/A parameter-to-prompt (P2P) injection vulnerability in Atlassian Rovo allowed unauthorized attackers to seed malicious instructions into enterprise AI sessions to exfiltrate data from connected Jira, Confluence, and SharePoint environments.Varonis Threat Labs disclosed a critical one-click vulnerability, dubbed RovoBlast, within Atlassian’s enterprise AI assistant, Rovo. The vulnerability stems from a parameter-to-prompt (P2P) injection flaw where the rovoChatPrompt URL parameter is treated as trusted input, allowing external attackers to inject arbitrary instructions directly into a user's live AI session. By crafting a URL with malicious content in the rovoChatPrompt parameter, an attacker can influence Rovo’s autonomous agents, such as ResearchAgent, to perform multi-step tasks. This enables the agent to autonomously retrieve sensitive information from integrated platforms - including Jira, Confluence, Bitbucket, SharePoint, and Microsoft 365 - and exfiltrate the data to external sites. The exploit is particularly dangerous because it requires no user permission bypass and can be triggered via a single malicious link. Atlassian has addressed the issue, but the findings highlight broader risks associated with autonomous AI agents that possess broad read-access to enterprise data.

Attack Chain

  1. Attacker crafts a URL targeting a victim's Rovo instance containing a malicious rovoChatPrompt parameter.
  2. The attacker leaves the organization ID field blank in the crafted URL, causing the Atlassian platform to default to the victim's organization context.
  3. The victim clicks the malicious link, initiating an active Rovo AI session seeded with the attacker’s injected instructions.
  4. The Rovo AI assistant executes the injected prompt, triggering its autonomous ResearchAgent tool.
  5. The ResearchAgent, leveraging its built-in access, traverses connected platforms like Jira, Confluence, and SharePoint to retrieve targeted data.
  6. The agent performs autonomous, multi-step operations to summarize or aggregate the sensitive content based on the injected instructions.
  7. The agent pushes the exfiltrated sensitive data to an attacker-controlled endpoint on the open web.

Impact

The RovoBlast attack allows unauthorized exfiltration of proprietary and sensitive enterprise information, including Jira tickets, Confluence pages, and SharePoint documents containing personal or financial data. This represents a significant risk for organizations using AI-integrated workflows. Because the agents operate autonomously, the impact is magnified, enabling high-volume data theft without requiring the attacker to manually interact with each exfiltrated document or record.

Recommendation

  • Perform an audit of all active Rovo integrations and disconnect any third-party or internal tools that are not strictly necessary for business operations.
  • Apply restricted access policies to sensitive repositories, specifically walling off directories containing legal, HR, or finance-related data from AI agent access.
  • Configure Rovo to disable autonomous features such as multi-step research or open-web browsing if they are not actively required for user tasks.
  • Establish monitoring and alerting for Rovo assistant activity logs to detect anomalous autonomous agent behavior or unusual outbound connections generated by AI agents.
  • Educate staff on the risks of clicking untrusted links that interact with AI assistant interfaces, treating them with the same security caution as traditional email-based phishing.
]]>highadvisoryai-securitydata-exfiltrationinjection