Atlassian went quiet for 75 days on a Rovo bug that leaks Jira tickets

Atlassian’s Rovo can read a poisoned document and quietly ship Jira tickets to a stranger’s server. PromptArmor published that proof of concept on August 5, and says it told Atlassian on May 23 and got nothing back beyond a case number.

Rovo is the agent Atlassian wired into Jira, Confluence, and its third-party connectors, so the blast radius is whatever the agent can already read. The part that should bother admins is the boundary. PromptArmor’s exfiltration still works with organization-wide web search switched off, which is the one control an Atlassian admin has for stopping Rovo from reaching the open internet.

How the data gets out

The class here is indirect prompt injection, and the chain is short. An instruction the victim never wrote lands in content Rovo will read, in PromptArmor’s demo a file someone uploads to the chat. Rovo follows it, pulls Jira tickets and Confluence pages the agent can reach, then builds a URL with that content packed in and fetches it. The attacker reads their own server logs. PromptArmor’s write-up puts the failure in one line: “Rovo’s URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent.”

The uploaded file is incidental. The same write-up lists other delivery paths, including “external data in Atlassian (e.g., support tickets), web data (if search is enabled), third-party ‘connectors’”. Nothing asks the user to approve the outbound fetch. PromptArmor describes the attack as executing “without requiring any human-in-the-loop approval”, so the victim’s only tell is a chat reply that reads slightly off.

Which brings up the control that didn’t hold. Atlassian gives org admins a web search switch under Rovo access, documented as the setting that lets people “switch or expand Rovo’s sources to public websites”. Flip it off and Rovo should stop touching the public web. PromptArmor’s finding is that it doesn’t: “This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.” The search box goes away. The fetcher stays.

Two claims are worth separating. Atlassian’s AI trust page says “Rovo respects all user permissions and access controls across Atlassian and connected third-party apps”, and PromptArmor doesn’t dispute it. The agent reads what the victim could already read. The gap is egress. No permission model says anything about an agent dropping a document it can legitimately see into a query string. OpenAI reached the same conclusion and shipped a lockdown mode that blocks the outbound step.

Atlassian’s side of it

The disclosure log runs five lines. May 23, 2026: report sent. May 25: Atlassian says thanks and assigns a case number. June 4 and July 29: PromptArmor follows up. August 5: the write-up goes public, 74 days after the first email. Atlassian has published no advisory and made no public statement as of this article going up.

Silence isn’t proof of inaction. A Bugcrowd disclosure filed by the researcher loacker covers a one-click cousin of this bug: a crafted rovoChatPrompt parameter on home.atlassian.com/chat that ran attacker text as though the user had typed it, then pushed Confluence content out through image fetches. Atlassian paid $6,000 in January and, per that report, deployed a server-side fix on July 8, 2026. Eight months from report to patch. A separate write-up by redtrib3 covers a third Rovo Chat injection, hidden in a Confluence page and leaking the victim’s email to a webhook, since resolved.

The Hacker News thread hit 264 points and 114 comments, and the practitioner read there is that the fetch tool is the design error rather than the model. Simon Willison narrowed the fix to one sentence: “Your URL retrieval tool should only work for URLs that have previously been typed into the conversation by a user or have been returned from a trusted tool.” Nobody from Atlassian posted in the thread. Anyone who followed the agentic-browser version of this attack will recognize the shape.

What’s still unknown

Four gaps, and the August 5 write-up closes none of them:

• Exploitation in the wild. No evidence either way. PromptArmor’s chain is a lab demo, and Atlassian has disclosed no incident.
• A fix in flight. Unknown. The July 8 Bugcrowd patch shipped without publicity, so an absent advisory proves nothing. No CVE has been assigned publicly either.
• Scope. Unclear. PromptArmor doesn’t break out plan tiers, or say whether Rovo Chat, Rovo Studio agents, and Rovo Dev all behave this way.
• The Markdown route. Unresolved. The write-up flags image rendering as a second exfiltration path, with no word on whether it’s live.

What this means for you

If Rovo is on in your tenant, the web search toggle is not the control you thought it was. Turning it off under Rovo access in Atlassian Administration is still worth doing, but plan on the fetch tool surviving it. Two moves shrink the blast radius today. Audit your Teamwork Graph connectors and disconnect the ones nobody uses, because every live connector widens what one injected line can reach. On Enterprise, block Rovo per app so the agent isn’t sitting in front of every project by default. Then reread your own tickets the way an attacker would. PromptArmor’s screenshot of the attacker log includes a Jira ticket about migrating non-prod secrets out of env vars. Secrets in ticket bodies were always a bad idea, and an agent with a URL fetcher turns them into a delivery mechanism.

The Bugcrowd case is the only cadence data anyone has: eight months from report to patch. PromptArmor’s report is 75 days in.