Rovo, Atlassian's AI Assistant, Can Be Tricked Into Leaking Jira and Confluence Data

Key points

• Researchers at PromptArmor and a second security firm independently showed that Atlassian's Rovo AI assistant can be tricked into sending private Jira and Confluence data to an outside server.
• The trick works by hiding instructions inside content that Rovo reads, such as an uploaded file or a page it processes.
• Rovo only fetches data the signed-in user is already allowed to see, so the risk scales with that person's access.
• Atlassian has fixed one of the two reported routes; the other is not confirmed closed.
• This is a prompt injection attack, a known weakness in AI assistants that read untrusted text.

Atlassian's AI helper Rovo, which sits inside Jira and Confluence and answers questions using a company's own tickets and wiki pages, can be tricked into handing that data to an attacker.

Two security firms found the problem separately, using different methods. Only one of those methods has been confirmed fixed.

The technique is called prompt injection. An attacker hides instructions inside a document or page, and when the AI reads that content, it follows the hidden instructions as if they came from the real user.

How does the attack actually work?

Someone plants secret commands in content Rovo will later read, then waits for a staff member to ask Rovo a normal question. Rovo obeys the hidden commands, pulls internal data the staff member can see, and sends it to a server the attacker controls.

PromptArmor, an AI security firm, ran the attack by hiding instructions in an uploaded file. When a user asked Rovo to process it, the assistant read the hidden text, gathered information from other Jira or Confluence pages the user had access to, and quietly shipped it out. The second research team, first reported by The Hacker News, used a different entry point that Atlassian has not publicly confirmed as patched. The uploaded-file route is the one Atlassian says is now closed.

We covered a structurally identical attack against Google's development toolkit on 4 August, where hidden instructions let a low-trust agent poison a higher-trust one.

Why is this worse than a normal bug?

Because Rovo acts with the signed-in user's permissions, the leak is only as big as that person's access. An intern's session leaks intern-level data. A senior engineer's session leaks roadmaps, customer tickets, internal wiki pages, and whatever else that account can reach.

There is no malware to install, no password to steal. The attacker just needs to get poisoned content in front of the AI. A shared Confluence space or an attached PDF can do the job.

This is not a Rovo-only problem. Any AI assistant that reads text from places users don't fully control carries the same weakness. It's the current soft spot of the whole category.

Should you worry if your company uses Rovo?

You don't need to do anything technical. Two habits help: be wary of asking the AI to process files from outside your team, especially anything sent in by a vendor or an external contact. And if your company posts a Rovo advisory, act on it promptly.

MFA wouldn't have helped. This isn't a login problem. The attacker never logs in as anyone. They ride on a legitimate user's session by tricking the AI that user is talking to. That's an authorisation design issue (what the AI is allowed to do on your behalf), not an authentication one (proving who you are).

What Atlassian has fixed, and what it hasn't

Atlassian users should watch the vendor's own security advisories for the next update, and treat any AI assistant that reads shared content as a system that can be told what to do by whoever wrote that content.