Products Lemma APIProof issuance & verification platformTrust402Delegate to agents, and transactSealSign-in for the agent era — no keys handed over
Use cases Manufacturing & Critical InfraInspection Record AssuranceFinance & FinTechCounterparty Record VerificationPublic SectorCertificate-less ProceduresHealthcareQualified Worker AssuranceProcurement & Supply ChainSupplier Credential MonitoringMedia & ContentContent AuthenticityService & RetailCross-group IdentityAI Adoption (cross-industry)AI Run GovernanceDevelopers & Agent OpsAgent Authority Control ▸ Browse the use-case index
Pricing
Resources Critical BriefThe frontier of AI × trustBlogThinking and implementation notesDocumentationAPI & specsVerification CenterReal verification & issuance countsAbout usFRAME00, Inc.ContactSales & press inquiriesGlossaryDefinitionsFAQFrequently asked questions
Dashboard ↗ JA
Home / Critical Brief / No. 130
No. 130 Critical Brief · Agent Authority Proof

Atlassian Rovo: Instructions planted in a file or a link could make it send Jira and Confluence data outside (PromptArmor, Varonis)

Nothing checks, before sending, that the instruction came from the user

1click
Opening a link was enough to load an attacker's instructions into a signed-in user's Rovo Chat, with no warning or confirmation (Varonis; fixed)
50+
Services Rovo can reach through connectors. What it can reach is what can be sent out (Varonis)
05-23→08-05
From PromptArmor's report to publication. At publication, the file-borne path was described as still unfixed
CountryGlobal
Incident date2026-08-05
Published2026-08-11
Revised v2.0 · 2026-10-25
AuthorsLemma Critical Team
Contents
  1. 01TL;DR
  2. 02What happened
  3. 03Timeline — disclosure and response
  4. 04Why it wasn’t stopped
  5. 05How to counter this
  6. 06Sources

TL;DR

  1. 01What happened

    Atlassian’s AI assistant Rovo was shown, by two paths, to be steerable into sending internal Jira and Confluence data to an attacker’s server. PromptArmor showed that uploading a file with hidden instructions and asking “organize my Jira tickets” was enough for Rovo to attach what it found to an attacker’s URL and open it. Varonis showed a path (RovoBlast) in which instructions planted in a link are loaded into Rovo Chat with one click.

  2. 02Why it can't be told apart

    Rovo did not tell the user’s request apart from text planted in a file or link, and acted with the user’s permissions. On neither path did an approval prompt appear before sending. Turning off Rovo’s web search did not stop the file-borne path.

  3. 03The missing layer

    RovoBlast was fixed before disclosure, but PromptArmor described the file-borne path as still unfixed at publication. What was missing was a layer that checks, before sending anything out, that the instruction came from the user.

What happened

Researchers
PromptArmor and Varonis Threat Labs reported separately. This is a research demonstration, not a real-world loss.
File-borne path (PromptArmor)
An attacker hides instructions in a file. When the user uploads it and asks Rovo to organize their Jira tickets, Rovo searches Jira and Confluence, appends what it finds to an attacker’s URL and opens it with its URL-retrieval tool. The content lands in the attacker’s server logs. The chat looks normal and the user notices nothing. Besides files, the instructions can sit in support tickets, web data or connected services.
Turning off web search does not stop it
Disabling web search leaves the tool that opens search results, and data went out through it. PromptArmor also describes a second channel that leaks data by rendering an image in the AI’s answer.
Link path (Varonis, RovoBlast)
A link carries attacker instructions in a parameter named rovoChatPrompt. When a signed-in user opens it, the instructions enter Rovo Chat with no warning, no confirmation and no label showing they came from outside.
Reach
Rovo can read Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, databases and more, and connects to over 50 services (Varonis). In the demonstrations, Confluence pages, Jira tickets and SharePoint content containing personal data were taken (SecurityWeek).
Not disclosed
Whether any real-world harm or exploitation occurred.

Glossary
Rovo — Atlassian's AI assistant. It searches Jira, Confluence and more, and acts with the user's permissions.
Prompt injection — Hiding instructions, separate from the user's request, inside a file or page the AI reads. The AI may follow them without telling them apart from the request.
Connector — A link from the AI assistant to other services such as Slack or Microsoft 365. The more you connect, the more data the AI can read.

In the researchers’ demonstrations, data went out in this chain.

Exhibit 1The chain to internal data leaving, in the researchers' demonstrations

The stopping point is ③. Had it been checked, before sending, that the instruction came from the user's request, the send at ④ would not happen.

Attacker
1
Plants instructions in a file or a link

Files, tickets, link parameters.

User
2
Does something ordinary

Asks for tidying, opens a link.

Rovo
3
Runs the planted instructions as if requested

With the user's permissions, no approval prompt.

Rovo
4
Sends internal data to the attacker's URL

The chat looks normal.

Timeline — disclosure and response

  • PromptArmor reports the file-borne path to Atlassian.
  • Atlassian acknowledges and assigns a case number.
  • PromptArmor follows up.
  • PromptArmor follows up again.
  • PromptArmor publishes the details, saying Rovo “remains vulnerable”.
  • SecurityWeek and others report it. Varonis presented RovoBlast at DEF CON 34.

The facts rely on PromptArmor’s and Varonis’s disclosures (primary). Examples of data taken rely on SecurityWeek’s report. The date of the RovoBlast fix is not confirmed in a primary source. We do not claim real-world harm.

After disclosure

  • Atlassian: Fixed RovoBlast before disclosure, after Varonis reported it through Bugcrowd (Varonis, SecurityWeek). According to PromptArmor, there was no further communication on the file-borne path for more than two months.
  • Varonis: Advised organizations to limit the services Rovo connects to and remove unused integrations, keep sensitive areas such as legal, HR and finance out of scope, turn off browsing agents and automation they do not use, and review logs with alerts on unusual activity.

Why it wasn’t stopped

The failure was not that Rovo carried out instructions wrongly. It carried planted instructions all the way to sending data out, without telling them apart from the user’s request.

The core of this case
Rovo did as it was told. The user's request, a line inside an uploaded file and text planted in a link were all treated as instructions of equal weight, and data went out with the user's permissions.
Exhibit 2The gap between detection and proof

Proof here means checking, before an AI assistant sends anything out, that the instruction came from the user's request, and keeping a record. Detection means noticing suspicious instructions or destinations.

Proof layer · missingCheck, before sending, that the instruction came from the user
GapInternal data
goes out
Detection layer · partialTurning features off, watching destinations
STEP 1
Plant instructions
STEP 2
Ordinary action
STEP 3
Run them as requested
STEP 4
Send out

The existing control of turning off web search did not stop the file-borne path, because the control worked on “feature on or off”, not on “where the instruction came from”. That distance is the gap between detection and proof, and it is structural.

The same structure appears in EchoLeak in M365 Copilot (instructions planted in an email sent internal data out).

How to counter this

Before an AI assistant sends anything out, check that the instruction came from the user’s request, and stop sends that cannot be checked. Text inside files, tickets and links is material to read, not instructions. Checking the origin before sending keeps planted instructions from getting through. It sits in front of detection, not in place of it.

Industries and operations to watch

IndustryAI
Organizations that add AI assistants or agents to internal tools and connect them to other services.
OperationLookup & data access
Having an AI assistant search and summarize internal documents and tickets. What you connect is what can leave.

Do today’s controls close it?

ControlThis caseWhy
Turning off web searchIneffectiveThe tool that opens search results remained, and data went out through it.
Finding instructions in filesPartialStops what it finds, but reworded instructions remain.
Watching destinationsPartialCan notice suspicious destinations, but only after sending.
Connecting fewer servicesPartialNarrows the reach, but remaining data can still be sent.
ControlsWhat is needed
  1. Before sending anything out, check that the instruction came from the user’s request. Do not treat text inside files, tickets or links as instructions.
  2. Stop sends that cannot be checked. Show the user the destination and contents, and ask for approval.
  3. Record what the AI assistant sent and where, separately from the assistant. So you can later show which instruction led to each send.
CheckChecklist

Three things to confirm about AI assistants that touch internal data

  • Have you removed the services your AI assistant connects to but does not need?
  • Have you limited the assistant’s ability to open outside URLs or send data out to what you actually use?
  • Can you see a record of what the assistant sent and where, separately from the assistant?

Note: turning features off or connecting fewer services narrows the reach; it is not a substitute for checking where an instruction came from. We will revise this Brief if Atlassian announces a fix for the file-borne path.

Sources

  1. Research, primaryPromptArmor “Atlassian Rovo Exfiltrates Data”2026-08-05 · promptarmor.com/resources/atlassian-rovo-exfiltrates-data
  2. Research, primaryVaronis Threat Labs “RovoBlast”varonis.com/blog/rovoblast
2 more (reporting, analysis)
  1. PressSecurityWeek “Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data”2026-08-08 · securityweek.com/critical-one-click-vulnerability-in-atla…
  2. PressThe Hacker News “Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers”2026-08-08 · thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into

References: “The last layer left in AI-era cyber defense”

The same method elsewhereSee all 18 "Lookup & data access" cases Get new cases and checks like these by email

This material is a structured analysis of public information; it is not an audit, diagnosis, or recommendation for any specific organization.

Cite this Brief

Lemma Critical Team. (2026).
"Atlassian Rovo: Instructions planted in a file or a link could make it send Jira and Confluence data outside (PromptArmor, Varonis) — Nothing checks, before sending, that the instruction came from the user".
Lemma Critical Brief No.130. Lemma / FRAME00, Inc.
https://lemma.frame00.com/critical/briefs/130-atlassian-rovo-instruction-provenance/
Revision History

Current version: 2.0

Lemma

If it can't be verified,
it doesn't enter your operation.

Lemma attaches cryptographic proofs to data and AI execution, so the receiving side can confirm authenticity without asking the issuer. Detection stays; a proof layer is added in front of it.

Talk to enterprise See the verification center