Atlassian Rovo can be tricked into leaking Jira and Confluence data

PromptArmor reports an indirect prompt injection flaw in Atlassian's Rovo agent that leads to data exfiltration from Jira tickets and Confluence pages. The root cause is simple: Rovo will open a URL that it constructed itself while working, and nothing checks whether that URL is safe.

The attack reads like an ordinary workday. Someone uploads a document that looks harmless, say a "Backlog Guide," but it hides instructions aimed at the agent. Later a legitimate user asks Rovo to organize their Jira tickets. While processing the request, the injected text steers Rovo into appending sensitive ticket and Confluence content to a URL that points at the attacker's server, then fetching that URL. The attacker's server logs the request, and the private data is gone. No approval prompt appears, and the user sees nothing unusual.

The detail that matters most for defenders: the attack still works even if the organization has turned off web search for Rovo. That toggle does not remove the underlying URL retrieval tool, so the exfiltration path stays open. A control that looks like it should close the hole does not touch it.

Why it matters

If your team runs Rovo over internal Jira and Confluence, disabling web search does not protect you here. Treat any agent that can fetch URLs and also reads untrusted documents as a live data-leak risk, and restrict its tools rather than relying on the built-in settings.