How does the Rovo prompt injection actually work?

The Rovo attack hides instructions inside a file the user uploads for a normal task such as organising Jira tickets. Rovo processes the injection alongside the legitimate request, builds URLs that append sensitive data, and its URL-retrieval tool then GETs those links. The attacker reads the leaked data straight out of their server access logs.

Does disabling web search protect a Rovo tenant?

Turning off web search does not block the Rovo exfiltration path. PromptArmor found the setting hides the search feature but leaves the underlying URL-retrieval tool available to the agent, so injected instructions can still dial out. The report also documents Markdown image rendering as a second exfiltration channel that the same toggle does not touch.

Did Atlassian respond to the disclosure?

PromptArmor disclosed the Rovo issues to Atlassian on 2026-05-23. Atlassian acknowledged receipt on 2026-05-25 and opened a case number, but PromptArmor reports no substantive follow-up across more than two months and multiple pings. At publication on 2026-08-05, the report states Rovo remains vulnerable.

What should Rovo admins do right now?

Treat any Rovo workspace with connected Jira and Confluence data as at risk from untrusted file uploads. Restrict who can attach documents that Rovo processes, monitor egress for unusual outbound requests to unknown domains, and review Markdown outputs that render external images. PromptArmor recommends full disable of file-upload workflows until Atlassian ships a fix.

PromptArmor · 2026-08-05 · major

Atlassian Rovo — zero-click prompt injection exfiltrates Jira and Confluence data

PromptArmor discloses a zero-click indirect prompt injection in Atlassian Rovo that ships Jira tickets and Confluence documents to an attacker's server. Disabling web search does not remove the URL-retrieval tool, and Atlassian has not patched since May.

PromptArmor diagram of the Atlassian Rovo prompt-injection exfiltration chain

A zero-click prompt injection turns Rovo's URL-retrieval tool into a data exfiltration channel for Jira and Confluence.

Key specs

Disclosure to atlassian	2026-05-23
Publication	2026-08-05
Days unpatched at publication	74+

Quick facts

Reporter	PromptArmor
Vendor	Atlassian (Rovo)
Attack class	Indirect prompt injection
User interaction	Zero-click after file upload
Data at risk	Jira tickets, Confluence pages
Exfil channels	URL retrieval tool + Markdown image render
Status	Unpatched at publication (2026-08-05)

What is it?

Atlassian Rovo, the AI agent that answers questions across Jira and Confluence, ships sensitive tickets and documents to an attacker's server when a user uploads a file carrying hidden instructions. PromptArmor disclosed the issue privately in May 2026 and published the technical write-up on August 5, 2026 because Rovo remains vulnerable.

How does it work?

An indirect prompt injection lives inside the uploaded file, so no clicks are required beyond the normal task. Rovo reads the injection, constructs URLs that append the sensitive data it just retrieved, and its URL-retrieval tool GETs those links; the attacker reads the payload from server logs. A second variant abuses Markdown image rendering as an alternative channel.

Why does it matter?

Rovo lives inside Atlassian Cloud, which is where many enterprises keep incident notes, roadmaps, HR files and customer data. The disclosure also shows that Atlassian's 'disable web search' toggle does not remove the underlying URL-retrieval tool, so admins who thought they had opted out are still exposed. Treat any file upload as an attack surface until a patch ships.

Who is it for?

Atlassian Cloud admins, AI-agent security teams

Frequently asked questions

How does the Rovo prompt injection actually work?: The Rovo attack hides instructions inside a file the user uploads for a normal task such as organising Jira tickets. Rovo processes the injection alongside the legitimate request, builds URLs that append sensitive data, and its URL-retrieval tool then GETs those links. The attacker reads the leaked data straight out of their server access logs.
Does disabling web search protect a Rovo tenant?: Turning off web search does not block the Rovo exfiltration path. PromptArmor found the setting hides the search feature but leaves the underlying URL-retrieval tool available to the agent, so injected instructions can still dial out. The report also documents Markdown image rendering as a second exfiltration channel that the same toggle does not touch.
Did Atlassian respond to the disclosure?: PromptArmor disclosed the Rovo issues to Atlassian on 2026-05-23. Atlassian acknowledged receipt on 2026-05-25 and opened a case number, but PromptArmor reports no substantive follow-up across more than two months and multiple pings. At publication on 2026-08-05, the report states Rovo remains vulnerable.
What should Rovo admins do right now?: Treat any Rovo workspace with connected Jira and Confluence data as at risk from untrusted file uploads. Restrict who can attach documents that Rovo processes, monitor egress for unusual outbound requests to unknown domains, and review Markdown outputs that render external images. PromptArmor recommends full disable of file-upload workflows until Atlassian ships a fix.

Try it

https://www.promptarmor.com/resources/atlassian-rovo-exfiltrates-data