Rovo, Atlassian's AI Assistant, Can Be Tricked Into Leaking Jira and Confluence Data

Key points

• Researchers at PromptArmor and a second security firm independently showed that Atlassian's Rovo AI assistant can be tricked into sending private Jira and Confluence data to an outside server.
• The trick works by hiding instructions inside content that Rovo reads, such as an uploaded file or a page it summarises.
• Rovo only fetches data the signed-in user is already allowed to see, so the risk scales with that person's access.
• Atlassian has fixed one of the two reported routes; the other is not confirmed closed.
• This is a prompt injection attack, a known weakness in AI assistants that read untrusted text.

Atlassian's AI helper Rovo, which sits inside Jira and Confluence and answers questions using a company's own tickets and wiki pages, can be tricked into handing that data to an attacker.

Two security firms found the problem separately, using different methods. Only one of those methods has been confirmed fixed.

The technique is called prompt injection. In plain terms: an attacker hides instructions inside a document or page, and when the AI reads that content, it follows the hidden instructions as if they came from the real user.

How does the attack actually work?

Someone plants secret commands in content Rovo will later read, then waits for a staff member to ask Rovo a normal question. Rovo obeys the hidden commands, pulls internal data the staff member can see, and sends it to a server the attacker controls.

PromptArmor, an AI security firm, ran the attack by hiding instructions in an uploaded file. When a user asked Rovo to summarise the file, the assistant read the hidden text, gathered information from other Jira or Confluence pages the user had access to, and quietly shipped it out. First reported by The Hacker News, the second research team used a different entry point that Atlassian has not publicly confirmed as patched.

The uploaded-file route is the one Atlassian says is now closed.

Why is this worse than a normal bug?

Because Rovo acts with the signed-in user's permissions, the leak is only as big as that person's access. An intern's Rovo session leaks intern-level data. A senior engineer's session leaks engineering roadmaps, customer tickets, and internal wiki pages.

There is no malware to install and no password to steal. The attacker just needs to get their poisoned content in front of the AI. A shared Confluence space, an attached PDF, or a Jira comment can all do the job.

This is not a Rovo-only problem. Any AI assistant that reads text from places users don't fully control has the same weakness. It is the current soft spot of the whole category.

What does this mean for ordinary users?

If your employer uses Jira, Confluence, or Rovo, you don't need to do anything technical. Two practical habits help:

Be wary of asking the AI to summarise files or pages from outside your team, especially anything sent in by a vendor, a customer, or a stranger. And if your company posts a Rovo advisory or asks you to update settings, do it promptly.

Would multi-factor authentication have helped here? Honestly, no. This is not a login problem. The attacker never logs in as anyone. They ride on a legitimate user's session by tricking the AI that user is talking to. That is an authorisation design issue (what the AI is allowed to do on your behalf), not an authentication one (proving who you are).

What Atlassian has fixed, and what it hasn't

Atlassian users should watch the vendor's own security advisories for the next update, and treat any AI assistant that reads shared content as a system that can be told what to do by whoever wrote that content.