Attackers Can Steal Enterprise Data With One Click Through Atlassian Rovo Flaw

Menu

A newly disclosed security flaw in Atlassian’s Rovo AI assistant is raising alarms across the cybersecurity community, and for good reason. Dubbed RovoBlast, the vulnerability allows attackers to hijack a trusted employee’s AI session using nothing more than a single crafted link, no stolen passwords, no malware downloads, and no obvious red flags for the person who clicks it.

The discovery, made by researchers at Varonis Threat Labs, lands at a moment when enterprises are racing to embed AI assistants deep into their daily workflows. Tools like Rovo promise faster research, smarter summaries, and seamless access across platforms such as Jira, Confluence, Bitbucket, Slack, Microsoft 365, and Google Workspace. That same breadth of access, researchers warn, is exactly what makes RovoBlast so dangerous.

For security teams, the flaw is a reminder that AI adoption is outpacing AI governance in many organizations. As companies grant these assistants broader permissions to boost productivity, attackers are already probing for the seams. RovoBlast may be one of the clearest examples yet of how a single click can quietly turn a helpful AI tool into a data exfiltration pipeline.

What Is the RovoBlast Vulnerability

How the Exploit Works

RovoBlast does not rely on jailbreaking Rovo or bypassing an employee’s account permissions. Instead, Varonis says it exploits what researchers call a parameter-to-prompt, or P2P, weakness. In plain terms, Rovo treats text embedded inside a URL as a legitimate, pre-filled chat instruction rather than as untrusted input from an outside source.<br>Baca JugaOpenAI Says Its AI Agents Built a Secret Message Board Before Hugging Face Hack

Attackers can build a malicious link using the rovoChatPrompt parameter to preload attacker-written instructions directly into Rovo Chat. A link following this pattern illustrates the mechanism:

https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=

Attack Element<br>Description

Trigger<br>A single click on a crafted link by a logged-in employee

Exploited Parameter<br>rovoChatPrompt

Vulnerability Type<br>Parameter-to-prompt (P2P) injection

Required Bypass<br>None: no jailbreak or permission escalation needed

Session Used<br>The victim’s own authenticated Rovo session

Potential Outcome<br>Unauthorized search, summarization, or movement of internal data

Why a Single Click Is Enough

Once an employee clicks the link while logged in, Rovo may interpret the embedded content as a direct instruction rather than flagging it as external input. Varonis noted that this creates a low-friction pathway for attackers, since the assistant can search, summarize, and potentially move organizational data without triggering warnings or confirmation prompts that would normally catch a suspicious action.

Because Rovo operates under the identity and permissions of the logged-in user, any actions carried out through a malicious prompt can look indistinguishable from ordinary AI-assisted research. That resemblance to routine activity is precisely what makes the exploit difficult for defenders to catch in real time.<br>Baca JugaOpenAI Settles DOJ Hiring Bias Case for $3.2 Million

Why Rovo’s Reach Makes This a Bigger Problem

An AI Layer Across the Enterprise Stack

Rovo is built to act as an AI layer spanning Atlassian’s core products, including Jira, Confluence, and Bitbucket, while also integrating with external platforms such as Slack, Microsoft 365, Google Workspace, databases, uploaded files, archives, and web resources. That interconnected design is central to Rovo’s productivity pitch, but it also means a single compromised session could touch a wide range of sensitive systems.

ResearchAgent Raises Additional Concerns

Varonis singled out Rovo’s ResearchAgent capability as a particular point of concern. This feature can carry out multi-step research and navigate websites autonomously, which researchers say could create a chain of events in which the assistant retrieves internal data, summarizes it, and sends it to an external destination, all stemming from one manipulated prompt.

Notably, the proof of concept did not require attackers to send repeated prompts or use elaborate jailbreak techniques to slip past safeguards. A single instruction was often enough to trigger retrieval of sensitive information, which further blurs the line between an attack in progress and everyday employee use of the tool.

How Organizations Can Respond

Limiting Exposure Through Access Controls

Security teams are being urged to minimize Rovo’s data footprint by disconnecting integrations that aren’t actively in use and excluding especially sensitive repositories, including legal, HR, finance, and incident-response systems, from the assistant’s reach altogether.<br>Baca JugaOpenAI Says Autonomous AI Hacks Mark a Watershed Moment for Security

Reducing Autonomous Capabilities

Organizations should also...