Atlassian Rovo Prompt Injection Data Exfiltration

Technical Analysis

This is a classic indirect prompt injection attack against an LLM-based agent (Rovo) that has tool-use access to enterprise data sources including Jira and Confluence. Attackers embed malicious instructions inside content that Rovo ingests during normal operation (such as an uploaded file), causing the agent to treat attacker text as legitimate commands, retrieve sensitive data the victim user has access to, and transmit it to an attacker-controlled endpoint. Because the exfiltration leverages the authenticated user's existing permissions, this bypasses traditional access controls and detection relying on anomalous authentication. PromptArmor identified one exploitation vector via file uploads; a second research firm found an independent route, and only one vector has been confirmed patched, meaning residual risk likely remains. This directly demonstrates agent-relevant risk: any organization deploying LLM agents with RAG-style access to internal knowledge bases, ticketing systems, or document stores faces similar exfiltration risk if input sanitization and output-destination controls for agent tool calls are insufficient.

Affected Systems

Atlassian Rovo AI assistant integrated with Jira and Confluence; any Atlassian Cloud instance where Rovo has been enabled with data access permissions for connected Jira/Confluence projects and spaces

Indicators of Compromise

• No specific hashes, IPs, or domains disclosed in source reporting; attack relies on attacker-controlled content (e.g., malicious uploaded files) containing embedded natural-language instructions rather than traditional malware artifacts

Remediation Steps

1. 1

   Restrict Rovo data access scope

   Limit Rovo's permissions to only the minimum necessary Jira/Confluence projects and spaces, avoiding broad organization-wide access grants.

2. 2

   Implement content sanitization for agent inputs

   Deploy filtering/sanitization on files, tickets, and pages that Rovo ingests to detect and strip embedded instruction-like text before processing.

3. 3

   Monitor and restrict outbound agent connections

   Apply egress controls or allow-lists to prevent AI agents from sending data to arbitrary external endpoints; log and alert on unusual outbound requests initiated by agent processes.

4. 4

   Apply vendor patches promptly

   Track Atlassian's official advisories and apply fixes for the confirmed exploitation vector; request clarification on the unpatched second vector and apply mitigations until resolved.

5. 5

   Conduct prompt injection testing

   Regularly red-team AI agents with tool/data access using adversarial prompt injection techniques to identify exfiltration paths before attackers do.