What happened
Two separate research efforts, detailed August 8, showed how Rovo, the AI assistant built into Atlassian's Jira and Confluence, could be turned against its own users. Varonis Threat Labs found that a chat-prompt URL parameter could preload attacker instructions into Rovo, so a single click by a signed-in user triggered the assistant to gather data the victim could access and smuggle it out through an attacker-controlled image address. Atlassian fixed that flaw, dubbed RovoBlast, server-side on July 8 and paid a $6,000 bounty through Bugcrowd. Separately, AI security firm PromptArmor demonstrated a content-based attack: hidden instructions embedded in a document that Rovo reads can direct the assistant to search Jira and Confluence and append what it finds to an attacker's URL, without any separate approval step. PromptArmor disclosed its findings on May 23 and said the fix status remained unconfirmed at publication. Neither team found evidence of real-world exploitation, and data reachable through SharePoint and Outlook connectors was also in scope.
Why it matters for your business
Thousands of small teams run their projects, tickets, and internal wikis on Jira and Confluence, and AI assistants like Rovo are being switched on across those workspaces by default. This research illustrates the core problem with assistants that read everything you can read: a poisoned document becomes an instruction set, and the assistant's reach becomes the attacker's reach. If Rovo can see an API key pasted into a Confluence page, so can an attack that manipulates Rovo.
What to do about it
- Review which users and apps have Rovo enabled and what connectors, like SharePoint and Outlook, it can reach
- Clean house: secrets such as API keys and passwords do not belong in wiki pages and tickets, with or without AI
- Be cautious with links that open your Atlassian tools with pre-filled chat prompts
- Ask vendors of any AI assistant how they defend against hidden instructions in the content the assistant reads