Varonis Discloses RovoBlast, a One-Click Prompt Injection Flaw in Atlassian's Rovo AI Assistant
A crafted link could seed attacker instructions into a user's Rovo session, letting the assistant's browsing agent exfiltrate Jira and Confluence data.
Overview
Security researchers at Varonis Threat Labs disclosed a vulnerability nicknamed RovoBlast that let a single clicked link inject attacker-controlled instructions into a signed-in user’s session with Atlassian’s Rovo AI assistant. The flaw, presented at DEF CON 34 and detailed in a Varonis blog post, allowed the assistant to retrieve data from connected systems such as Jira and Confluence and send it to an attacker-controlled server, according to The Hacker News.
What We Know
The attack exploited the rovoChatPrompt URL parameter, which Rovo used to preload content directly into its chat interface. The Hacker News reported that Varonis Threat Labs “found that the rovoChatPrompt URL parameter would preload attacker instructions into Rovo Chat, so one click from an authenticated user was enough for Rovo to run them with that user’s privileges and send the results to an attacker-controlled server.”
Varonis researcher Dolev Taler described the mechanism in a blog post, saying “a single click on a link triggers the attacker’s embedded instructions and forces Rovo to accept externally supplied parameters as trusted inputs within a user’s session,” according to CSO Online, which reported that Taler dubbed the attack “RovoBlast.”
No advanced bypass technique was required. CSO Online reported that “the researchers said they did not need a jailbreak, a double request technique, or a complicated prompt-surgery attack. The single culprit clicking on the crafted Rovo link was enough to seed the malicious instructions,” according to CSO Online. Infosecurity Magazine similarly reported that Varonis described Rovo’s guardrails around untrusted prompts as “almost non-existent,” and that one click was usually enough to have the assistant retrieve and summarize sensitive material without any bypass technique. The outlet also reported that the organization identifier in the request path “could also be left empty, with Atlassian redirecting the request into the user’s default organization.”
Once seeded, the malicious instructions could be carried out by Rovo’s ResearchAgent capability. Infosecurity Magazine reported that the ResearchAgent “performs multi-source open web research and can browse and navigate arbitrary websites across multiple steps autonomously,” creating a path for the assistant to move retrieved data out to an external destination.
Rovo’s reach into enterprise systems is broad. CSO Online reported that “Varonis found that Rovo could enumerate and search data across a wide range of sources available to an organization, including Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files, webpages, and archives,” and that “Rovo connectors extend reach to more than 50 platforms.” In a proof-of-concept, The Hacker News reported that “the reporter demonstrated exfiltration of a private API key from Confluence, and Bugcrowd says the same one-click technique was tested against Jira and data reachable through SharePoint and Outlook connectors.”
Varonis identified RovoBlast as part of a broader technique pattern. Infosecurity Magazine reported that “Varonis called the pattern Parameter-to-Prompt, and identified the same primitive in Microsoft Copilot in January under the name Reprompt.” CSO Online reported that Varonis “drew parallels with other recently disclosed AI attacks like SearchLeak, EchoLeak, ShadowLeak, and Antigravity,” framing RovoBlast as another instance of a broader issue where “untrusted inputs, autonomous behavior, and trusted communication” combine to create data exposure.
The issue was reported through Atlassian’s bug bounty program on Bugcrowd. The Hacker News reported that “the Bugcrowd record shows Atlassian fixed it server-side on July 8, 2026, and the reporter validated the fix,” and that “the report is rated P2 on Bugcrowd’s priority scale and drew a $6,000 bounty.” The outlet also reported that “neither disclosure carries a CVE identifier, and searches of NVD and CISA’s Known Exploited Vulnerabilities catalog returned none for either issue as of August 8, 2026.”
CSO Online reported that Atlassian “did not immediately respond to CSO’s request for comments.”
What We Don’t Know
Atlassian has not publicly detailed the exact server-side change that closed the vulnerability, and none of the outlets that covered the disclosure obtained comment directly from the company. It also remains unclear how many customer environments, if any, were exposed to a real-world exploitation attempt before the fix shipped, since the reporting describes only the researchers’ own proof-of-concept tests against Confluence, Jira, SharePoint, and Outlook connectors.
Mitigation
Infosecurity Magazine reported that “Rovo cannot be fully removed from an Atlassian environment, so organizations cannot eliminate the attack surface by uninstalling it.” Taler told CSO Online that “organizations attempting to remove the risk may not be able to eliminate Rovo’s presence in their environment or the associated attack surface, making robust input validation and security controls even more critical,” adding that “Rovo includes built-in automation that accelerates exfiltration once misused.”
According to The Hacker News, “Rovo is on by default for apps on Standard, Premium, and Enterprise plans, and everyone in an organization can use its features, according to Atlassian’s documentation,” meaning the exposure was not limited to organizations that had opted in to the assistant.