Two independent security research firms have demonstrated that Atlassian's Rovo AI assistant can be weaponized against the very tenants it serves. By embedding attacker-controlled instructions into content that Rovo ingests — uploaded files, Jira tickets, Confluence pages — an adversary can coerce the assistant into collecting data accessible to a signed-in user and transmitting it to an external, attacker-controlled server. PromptArmor, an AI security firm, demonstrated one route by hiding malicious instructions inside an uploaded file that Rovo reads. A second firm reached the same outcome via a different path. Critically, only one of those two routes is confirmed closed as of this writing.
This is not a theoretical AI risk thought experiment. It is a working indirect prompt injection attack against a production SaaS AI assistant with deep, permissioned access to two of the most data-rich systems in most enterprises: Jira and Confluence. If your organization has enabled Rovo, you have a new, largely unmonitored exfiltration channel operating under legitimate user sessions.
Why This Matters to Defenders
Rovo operates with the access rights of the user invoking it. That is the core problem: the assistant is a confused deputy. When a user asks Rovo to summarize a ticket, search a space, or analyze an uploaded document, Rovo reads that content and follows instructions embedded in it — including instructions the user never wrote and never saw.
The attack chain, from a defender's perspective:
- Delivery: The attacker plants instructions in content Rovo will read — an uploaded attachment, a Jira issue comment, a Confluence page, or content in an externally connected data source. No malware, no endpoint execution, no phishing click in the traditional sense.
- Invocation: A legitimate, signed-in user asks Rovo a routine question that causes it to ingest the poisoned content.
- Hijack: The hidden instructions override or augment the user's request, directing Rovo to gather sensitive data the user can access — project details, credentials pasted into tickets, customer data, internal documentation.
- Exfiltration: Rovo is instructed to send the collected data to an external server — for example, by constructing and fetching a URL containing the data as parameters, or generating a link/image reference pointing to attacker infrastructure.
The exploitation requirements are trivially low: the attacker needs the ability to place content somewhere Rovo will read it. In many organizations, Jira Service Management portals accept tickets and attachments from external customers. That alone is a viable delivery channel.
Exploitation Status
- No CVE has been assigned to this behavior as of publication. Do not expect one promptly — AI assistant behavioral flaws increasingly ship without CVE identifiers, which means your vulnerability management tooling will not flag this.
- Not in CISA KEV — again, because there is no CVE, KEV tracking is unlikely to help you here.
- Confirmed working attacks: Two independent firms reproduced data exfiltration via distinct routes. Only one route is confirmed remediated. Treat the second route as an open, unpatched attack path and govern Rovo accordingly.
Detection & Response
Honest assessment first: this is a hard detection problem. The exfiltration egress originates from Atlassian's cloud infrastructure, not your network — your perimeter proxy will never see it. Your detection strategy must therefore operate at three layers: (1) Atlassian audit and access logs for anomalous Rovo activity, (2) content inspection of uploaded/ticket content for injection markers before and after ingestion, and (3) egress and DNS monitoring on your side for the downstream indicators (users clicking Rovo-rendered attacker links, unusual destinations referenced in AI output).
SIGMA Rules
The following rules target observable behaviors across the layers you control: injection markers in uploaded content, and egress/redirect patterns consistent with AI-rendered exfiltration links.
---
title: Prompt Injection Markers in Content Uploaded to Collaboration Platforms
id: 3f8c2a71-9b4e-4d5a-8f1c-7e2b9a0d4c31
status: experimental
description: Detects common indirect prompt injection phrases inside file names or content staged for upload to SaaS collaboration platforms such as Jira and Confluence, consistent with reported attacks against Atlassian Rovo.
references:
- https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html
- https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: file_event
product: windows
detection:
selection_content:
TargetFilename|contains:
- 'ignore all previous instructions'
- 'ignore previous instructions'
- 'disregard your instructions'
- 'you are now in developer mode'
- 'system prompt'
- 'send the following data to'
- 'exfiltrate'
- 'fetch this url'
condition: selection_content
falsepositives:
- AI security research teams testing their own assistants
- Red team engagements authorized by the organization
level: medium
---
title: Outbound Connection to Rare External Domain Referenced by AI Assistant Output
id: 8a1d5e92-4c3b-4f6a-9d2e-1b7c3a5f8e62
status: experimental
description: Detects browser or process connections to external domains with URL parameters consistent with data appended by an AI assistant following injected instructions, such as long encoded query strings on rarely seen domains.
references:
- https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html
- https://attack.mitre.org/techniques/T1567.002/
author: Security Arsenal
date: 2026/08/10
tags:
- attack.exfiltration
- attack.t1567.002
- attack.command_and_control
logsource:
category: proxy
detection:
selection:
c-uri-query|contains:
- 'data='
- 'content='
- 'extract='
- 'summary='
- 'payload='
filter_known_good:
r-dns|contains:
- 'atlassian.net'
- 'atlassian.com'
- 'google.com'
- 'microsoft.com'
- 'office.com'
condition: selection and not filter_known_good
falsepositives:
- Legitimate web applications using descriptive query parameter names
- Tune the r-dns allowlist to your environment's top business domains before enabling
level: low
The proxy rule is intentionally conservative. Long, encoded query strings against rare domains are a weak-but-real signal for AI-rendered exfil links — pair it with the KQL hunt below rather than running it as a standalone high-fidelity alert.
KQL — Microsoft Sentinel
This hunt assumes you are ingesting Atlassian audit logs (available via the Atlassian REST API / Organization audit log for Atlassian Guard subscribers) and proxy/firewall telemetry into Sentinel. The first query hunts for bursts of Rovo-assisted data access by a single user — the classic shape of an injection-coerced collection job.
// Hunt 1: Anomalous Rovo data-access bursts per user (requires Atlassian audit log ingestion as AtlassianAudit_CL or via CommonSecurityLog)
let Lookback = 14d;
AtlassianAudit_CL
| where TimeGenerated > ago(Lookback)
| where Action_s contains "rovo" or Message contains "rovo"
| summarize RovoEvents = count(), DistinctObjects = dcount(ObjectId_s) by UserId_s, bin(TimeGenerated, 1h)
| where DistinctObjects > 50 // tune: baseline your normal Rovo usage first
| order by DistinctObjects desc;
// Hunt 2: Proxy/Zscaler/Firewall egress to rare domains with long encoded query strings (potential AI-rendered exfil links)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor in ("Zscaler", "Palo Alto Networks", "Fortinet", "Check Point") or isnotempty(RequestURL)
| extend Url = coalesce(RequestURL, DestinationHostName)
| extend QueryLength = strlen(extract(@"\?(.+)$", 1, Url))
| where QueryLength > 200
| summarize Hits = count(), max(QueryLength) by SourceIP, DestinationHostName
| where Hits < 5 // rare destination + long query = worth an analyst's eyes
| order by max_QueryLength desc;
// Hunt 3: Endpoint file events where staged attachments contain injection phrases (Defender EDR)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("Downloads", "Temp", "Attachments")
| where FileName has_any ("prompt", "instructions", "system")
| join kind=inner (
DeviceProcessEvents
| where ProcessCommandLine has_any ("jira", "confluence", "atlassian")
) on DeviceId
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName;
Baseline before you alert. Rovo adoption varies wildly between tenants; Hunt 1's threshold of 50 distinct objects per hour is a starting point, not gospel.
Velociraptor VQL
For endpoint-side hunts where users download or stage content later uploaded to Jira/Confluence, this artifact scans recent downloads and temp directories for text-bearing files containing injection phrase markers.
-- Hunt for files containing indirect prompt injection markers staged on endpoints
-- Scope: user Downloads and Temp directories, text-like files under 5MB, last 14 days
LET patterns = '(?i)(ignore (all )?previous instructions|disregard (your|all) instructions|send the (following|above) (data|content) to|exfiltrate|fetch this url|you are now (in )?developer mode)'
SELECT FullPath, Size, Mtime,
upload(file=FullPath) AS Sample
FROM glob(globs=['C:/Users/*/Downloads/**', 'C:/Users/*/AppData/Local/Temp/**'],
accessor='ntfs')
WHERE NOT IsDir
AND Size < 5000000
AND Mtime > now() - 1209600
AND FullPath =~ '\.(txt|md|csv|html|htm|xml|json|log)$'
AND read_file(filename=FullPath, length=500000) =~ patterns
Remediation / Hardening Script
Until the second attack route is confirmed closed, run content hygiene scans against externally sourced material entering Jira and Confluence. This Bash script pulls recently created Jira issues with attachments via the REST API and scans attachment text for injection markers — suitable for a scheduled CI or SOAR job.
#!/bin/bash
# Scan recent Jira issues' attachments for prompt injection markers
# Requires: Jira API token with browse permission; run daily via cron/SOAR
JIRA_BASE="https://your-domain.atlassian.net"
AUTH="soc-bot@yourdomain.com:${JIRA_API_TOKEN}"
LOOKBACK="-1d"
# Injection marker patterns observed in indirect prompt injection research
PATTERN='ignore (all )?previous instructions|disregard (your|all) instructions|send the (following|above) data to|fetch this url|developer mode|system prompt'
# Find issues created in the lookback window, prioritizing externally sourced tickets
ISSUES=$(curl -s -u "$AUTH" -G "$JIRA_BASE/rest/api/3/search" \
--data-urlencode "jql=created >= $LOOKBACK AND attachments is not EMPTY" \
--data-urlencode "fields=attachment,reporter" \
--data-urlencode "maxResults=100" | jq -r '.issues[].key')
for ISSUE in $ISSUES; do
ATTACH_URLS=$(curl -s -u "$AUTH" "$JIRA_BASE/rest/api/3/issue/$ISSUE?fields=attachment" \
| jq -r '.fields.attachment[].content')
for URL in $ATTACH_URLS; do
CONTENT=$(curl -s -u "$AUTH" "$URL" | strings | head -c 500000)
if echo "$CONTENT" | grep -Eiq "$PATTERN"; then
echo "[ALERT] Injection markers found in attachment on $ISSUE ($URL)"
# Webhook to your SOAR/SIEM for case creation
curl -s -X POST "$SOAR_WEBHOOK_URL" \
-H 'Content-Type: application/json' \
-d "{\"alert\": \"prompt_injection_marker\", \"issue\": \"$ISSUE\", \"attachment\": \"$URL\"}"
fi
done
done
Adapt the JQL to target your highest-risk intake paths first — service desk portals that accept external customer submissions are your primary delivery surface.
Remediation and Risk Reduction
There is no patch you can deploy yourself for the server-side behavior — this is Atlassian's code. Your remediation is architectural and procedural:
- Confirm your Rovo exposure immediately. Inventory every site where Rovo is enabled and which data sources it indexes (Jira, Confluence, and any third-party connectors). If Rovo is enabled but unowned from a security standpoint, that is your first gap.
- Track Atlassian's remediation of the second route. Monitor Atlassian's security advisories (https://www.atlassian.com/trust/security/advisories) and the Atlassian Trust Center. Do not assume the issue is fully resolved — only one of two demonstrated routes is confirmed closed. Ask your Atlassian account team directly for written confirmation of which routes are remediated.
- Gate external content from Rovo's context. Where configuration permits, restrict Rovo's access to spaces and projects that ingest unauthenticated or customer-submitted content. An AI assistant that reads attacker-writable input is an injection target by definition.
- Enforce least privilege rigorously. Rovo inherits user permissions. Every over-permissioned Jira/Confluence account is now a larger blast radius. Audit project and space permissions, especially for broad-access service accounts and groups.
- Deploy Atlassian Guard (if licensed) for audit log visibility and ship those logs to your SIEM. Without audit telemetry, the KQL hunts above are dead letter.
- Stand up content screening for externally submitted tickets and attachments using the script above or an equivalent SOAR playbook. Treat prompt injection markers in inbound content with the same seriousness as macro-enabled attachments from unknown senders.
- Brief your users. Anyone using Rovo to summarize or analyze externally sourced content should understand that the assistant can be manipulated by the content itself. This is the AI-era equivalent of "don't enable macros."
- Update your IR playbooks. Add an AI-assistant exfiltration scenario: indicators include unusual Rovo query bursts, AI output containing external links, and data-access patterns inconsistent with the user's role.
The Bigger Picture
Indirect prompt injection is the first AI-native attack class that is simultaneously low-skill, high-impact, and nearly invisible to conventional security tooling. There is no CVE pipeline catching up here, no KEV listing to anchor your SLA, and no EDR agent on the inference layer. Defense-in-depth for AI assistants means controlling what they can read, what they can reach, what their users can access, and what telemetry you collect when all three are abused. Organizations that treat AI assistants as productivity features rather than privileged identities with network reach will keep learning this lesson the hard way.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.