9 minhigh
RovoBlast: How One Click Triggered Atlassian’s AI Assistant to Leak Data
Varonis Threat Labs disclosed a Parameter-to-Prompt (P2P) vulnerability in Atlassian Rovo where a crafted URL using the rovoChatPrompt parameter injects attacker instructions directly into a user's trusted Rovo Chat session. Rovo's federated access across Atlassian products and connected SaaS platforms, combined with the ResearchAgent tool's ability to browse and post to arbitrary external websites, created a one-click data exfiltration chain requiring no jailbreak or guardrail bypass. Atlassian fixed the vulnerability after responsible disclosure via Bugcrowd.
Conf:high
Showing defanged values
- urlhxxps://home[.]atlassian[.]com/chat?rovoChatPathway=chat&rovoChatPrompt=Crafted URL pattern used to inject attacker-supplied prompts into a user's Rovo Chat session via the rovoChatPrompt parameter. A single click on a link using this pattern auto-surfaces attacker instructions as trusted input without warnings or confirmations.
Detection / Hunteropenrouter
What Happened
Researchers found that Atlassian's AI assistant called Rovo could be tricked into leaking company data when a user clicks a single malicious link. The link injects hidden instructions into Rovo's chat that the AI treats as if the user typed them. Rovo can search across Jira, Confluence, Slack, Google Workspace, Microsoft 365, and many other connected tools, so the injected instructions can retrieve sensitive information. A built-in Rovo feature called ResearchAgent can then send that data to an external website the attacker controls. No password theft or system break-in was needed. Atlassian fixed the problem after being notified. Organizations using Rovo should review which systems it can access, disable unused AI agent features, and monitor Rovo activity logs for unusual behavior.
Key Takeaways
- Atlassian Rovo AI assistant accepted externally supplied URL parameters via the rovoChatPrompt parameter that were interpreted as trusted instructions inside a user's session without warnings or confirmations.
- Rovo's federated access layer spans Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, and 50+ connectors, giving injected prompts broad reach across organizational data.
- The built-in ResearchAgent tool provided a turnkey exfiltration path: it can browse arbitrary external websites and post internal data to the public web as part of autonomous multi-step research actions.
- The vulnerability required no jailbreak, permission bypass, or prompt-surgery exploit. A single click on a crafted link was sufficient to retrieve and summarize sensitive data.
- Atlassian fixed the issue after responsible disclosure via Bugcrowd. The research was presented at DEF CON 34.
Affected Systems
- Atlassian Rovo AI assistant
- Atlassian Jira
- Atlassian Confluence
- Atlassian Bitbucket
- Connected SaaS integrations: Slack, Google Workspace, Microsoft 365, GitHub, GitLab, Azure DevOps
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attacker sends a victim a crafted link containing the rovoChatPrompt parameter with embedded instructions targeting home.atlassian.com/chat
- Execution: Victim clicks the link. Rovo loads the parameter value directly into the chat entry field and executes it as a trusted instruction within the user's authenticated session
- Discovery: Injected prompt instructs Rovo to enumerate and search across connected data sources including Jira, Confluence, Bitbucket, Slack, Google Workspace, and Microsoft 365
- Collection: Rovo retrieves and summarizes sensitive organizational data from connected platforms using the victim's existing access permissions
- Exfiltration: ResearchAgent tool autonomously browses to an attacker-controlled external website and posts the collected internal data as part of its multi-step web research workflow
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide detection rules or queries. It describes the vulnerability mechanics and recommends monitoring Rovo assistant logs and alerting on unusual agent runs.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The attack occurs entirely within the Atlassian Rovo web application and SaaS layer. EDR agents on endpoints would only see browser traffic to legitimate Atlassian domains. The prompt injection and data retrieval happen server-side within Rovo's infrastructure. |
| Network Visibility | Medium | Network monitoring could detect Rovo sessions where ResearchAgent browses to unusual external websites shortly after a session is initiated via a rovoChatPrompt parameter. HTTPS encryption limits payload visibility, but SNI and destination domain analysis remain possible. |
| Detection Difficulty | Hard | The attack executes under a legitimate user's identity and blends into normal AI-assisted workflow patterns. Rovo agent actions look like routine research activity. Distinguishing abuse from legitimate use requires behavioral analysis of prompt content, agent action sequences, and external browsing destinations, which most organizations do not currently log or monitor. |
Required Log Sources
- Atlassian audit logs
- Rovo agent execution logs
- Web proxy logs for outbound traffic from Atlassian infrastructure
- SaaS application access logs for connected integrations (Slack, Google Workspace, Microsoft 365)
- Identity provider session logs for Atlassian
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Rovo Chat sessions initiated via URLs containing the rovoChatPrompt parameter, as these indicate externally seeded prompts rather than user-typed input. | Atlassian audit logs, web proxy URL logs, browser history | Initial Access | Medium. Legitimate sharing of Rovo links with pre-filled prompts for collaboration purposes would trigger this signal. |
| Consider hunting for Rovo ResearchAgent invocations that browse to external websites not previously accessed by the organization, especially within a short time window after session initiation. | Rovo agent execution logs, outbound web proxy logs from Atlassian infrastructure | Exfiltration | Medium. Legitimate research tasks may also browse to novel external websites. |
| Consider hunting for Rovo sessions where the assistant queries multiple connected data sources (Jira, Confluence, Slack, Google Workspace) in rapid succession followed by an external web request, as this pattern matches the fetch-transform-upload exfiltration chain. | Rovo agent execution logs, SaaS application access logs | Collection and Exfiltration | Low to Medium. This multi-source-then-external pattern is less common in routine use. |
| Consider hunting for Rovo sessions where the organization ID in the URL is empty or missing, as the article notes Atlassian redirects to the user's default organization in this case, which can be abused to target a specific tenant. | Atlassian access logs, web proxy URL logs | Initial Access | Low. Empty organization ID in URLs is atypical for normal navigation. |
Control Gaps
- DLP solutions would not detect data exfiltration through Rovo's ResearchAgent because the data leaves through Atlassian's infrastructure as legitimate agent web browsing activity.
- Network firewalls would not block the attack because all traffic flows to and from legitimate Atlassian domains.
- Identity-based access controls would not prevent the attack because Rovo operates under the victim's legitimate session and inherited permissions.
- Traditional SIEM correlation rules may not cover SaaS AI agent activity logs, leaving the exfiltration chain undetected.
Key Behavioral Indicators
- Rovo Chat sessions initiated with rovoChatPrompt URL parameter present in the referring URL
- ResearchAgent tool invoked within seconds of a new Rovo Chat session starting
- Rovo agent browsing to external domains that have no prior history in the organization's web proxy logs
- Rovo sessions querying multiple connected data sources in a single agent run followed by outbound web requests
- Rovo Chat URLs with empty or missing organization ID parameter
False Positive Assessment
Medium. Rovo Chat sessions initiated with rovoChatPrompt parameters may occur during legitimate collaboration where users share pre-filled prompts. ResearchAgent browsing to external websites is a normal function of the tool. Distinguishing malicious use from legitimate AI-assisted research requires behavioral analysis of the prompt content, data access patterns, and external browsing destinations.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing Atlassian Rovo configuration to confirm the patched version is deployed in your environment.
- Consider auditing which Rovo Connectors are enabled and disconnecting any integrations that are not actively needed, especially for high-sensitivity systems.
- If supported by your Atlassian administration tools, consider disabling or restricting the ResearchAgent tool and other browsing/multi-step automation features if they are not required for business operations.
- Consider reviewing Rovo assistant logs for sessions that used the rovoChatPrompt parameter or invoked ResearchAgent with external web browsing, as these may indicate prior exploitation attempts.
Infrastructure Hardening
- Consider implementing network-level restrictions on outbound traffic from Atlassian infrastructure to external websites if your architecture supports egress filtering for SaaS platforms.
- Evaluate whether Rovo's access to high-sensitivity data repositories (legal, HR, finance, incident response) can be scoped or excluded entirely through Atlassian permission configuration.
- Consider implementing alerting on Rovo agent executions that involve external web browsing, especially when preceded by multi-source internal data queries.
- If applicable, evaluate whether your SaaS Security Posture Management (SSPM) tool can monitor and enforce Rovo connector configurations and agent feature settings.
User Protection
- Consider training users to treat unexpected links to Atlassian Rovo with the same caution as other phishing vectors, especially links received via email, chat, or external channels.
- If your browser security tooling supports it, consider alerting on or blocking URLs containing rovoChatPrompt parameters from external sources.
- Consider reviewing which users have Rovo enabled and whether access is appropriate for their role, particularly for users with broad data access permissions.
Security Awareness
- Consider incorporating AI prompt injection awareness into existing security training programs, emphasizing that AI assistants can be manipulated via crafted links.
- Consider adding guidance for employees to report suspicious Rovo Chat behavior, such as unexpected prompts appearing in their chat or Rovo autonomously browsing to unfamiliar websites.
- If your organization uses multiple AI assistants beyond Rovo, consider expanding awareness training to cover the general risk of Parameter-to-Prompt attacks across all AI-enabled platforms.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Collection
Tactic
Exfiltration
Additional IOCs
- Other:
rovoChatPrompt- URL parameter name used as the Parameter-to-Prompt injection vector. When included in a link to home.atlassian.com/chat, its value is loaded directly into the Rovo Chat entry field and interpreted as a user instruction.rovoChatPathway=chat- URL parameter that routes the user to the Rovo Chat interface. Used in combination with rovoChatPrompt to deliver the injected prompt payload.
