Summary
- Varonis found that a crafted link could introduce attacker-controlled instructions into an Atlassian Rovo session after a user clicked it.
- Rovo can work across Atlassian products and connected SaaS services, increasing the data reach available through a legitimate user session.
- Atlassian fixed the reported issue before Varonis published its research, and the disclosure does not report malicious exploitation.
A vulnerability in Atlassian Rovo allowed researchers to turn a crafted link into attacker-controlled instructions executed inside a user’s trusted AI session, demonstrating how delegated agent permissions can widen the consequences of input manipulation.
Varonis Threat Labs disclosed the technique, which it calls RovoBlast, on 7 August after reporting the flaw to Atlassian. Varonis said Atlassian fixed the issue before publication. Its disclosure does not report malicious exploitation.
The attack did not depend on stealing credentials or bypassing the victim’s existing permissions. Varonis found that a parameter used to pre-populate Rovo Chat could carry attacker-supplied content. When a user followed a specially constructed link, those instructions could enter the Rovo session under the user’s identity.
That distinction is central to the risk. Rovo operates across Atlassian products including Jira, Confluence, and Bitbucket, while connectors can also make information from services such as Microsoft 365, Google Workspace, and Slack available to the AI layer.
Varonis said Rovo could enumerate a broad range of connected data sources during testing and pointed to Atlassian’s connector ecosystem, which supports more than 50 platforms.
The resulting attack surface differs from that of a chatbot confined to producing text from a narrow prompt. An enterprise agent that can search internal systems, retrieve information, browse, and work across integrations inherits part of the trust already granted to the person using it.
RovoBlast exploited that relationship rather than defeating the identity system. Actions occurred inside a legitimate user session and remained bounded by the access available through that session. The security problem was that the instruction entering the session did not necessarily reflect the user’s intent.
Varonis described a route in which externally supplied instructions could be combined with Rovo’s data access and agent capabilities to create an exfiltration chain. The research therefore illustrates why prompt-injection weaknesses become more consequential as AI systems gain the ability to reach business data and perform multi-step tasks.
Traditional identity controls still establish part of the boundary. RovoBlast did not grant a user access to information for which the underlying identity lacked permission. But legitimate enterprise permissions can already be extensive, particularly where an agent combines access across systems that would otherwise be searched independently.
That creates a concentration effect. An agent can become a single interface across several trust domains while technically operating within authorised permissions. A security control therefore needs to distinguish not only whether the user may access the data, but whether the instructions driving the agent actually came from the user.
The issue extends beyond Atlassian. Enterprise agents are increasingly positioned between users and collaboration suites, document stores, code repositories, SaaS platforms, and workflow systems. As integrations accumulate, the security boundary becomes a combination of identity, connector scope, agent behaviour, and the provenance of instructions entering the model.
Atlassian’s fix closes the specific path reported by Varonis, which disclosed the work through the company’s vulnerability-reporting process before presenting it publicly.
The broader architecture remains relevant after that remediation. An AI layer does not need extraordinary new privileges to become a high-value control point. Ordinary user permissions become more powerful when one agent can exercise them across many connected services from a single interaction.
