RovoBlast: One-Click Hijacking of Enterprise AI Permissions for Data Exfiltration

RovoBlast: One-Click Hijacking of Enterprise AI Permissions for Data Exfiltration 1. Basic Information - Article Title: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data - Publisher: SecurityWeek - Publication Date: August 8, 2026, 07:30 ET (20:30 JST) - Original Source: SecurityWeek - Primary Source: Varonis Threat Labs - Attack Name: RovoBlast - Attack Techniques: Parameter-to-Prompt (P2P) injection, indirect prompt injection, agentic data exfiltration - Affected Products: Atlassian Rovo, Rovo Chat, ResearchAgent, Jira, Confluence, Bitbucket, and SaaS connected via Rovo Connectors - CVE: Not published - Patch Status: Patched by Atlassian before public disclosure - Severity: High No active exploitation has been reported. The Proof of Concept (PoC) successfully exfiltrated Confluence pages, Jira tickets, and SharePoint content containing personal data. 2. Summary in One Sentence By getting a user to click a single URL with an embedded command in rovoChatPrompt , an attacker caused Rovo to process external input as a trusted user prompt, search Jira, Confluence, SharePoint, and other systems using the user's permissions, and send the data externally via the ResearchAgent's autonomous web operations. 3. Attack Flow Chain A: Acquiring Enterprise Data via Parameter-to-Prompt - The attacker creates a link in this format: https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt= - Even if the organization ID is omitted, Atlassian redirects the user to their default organization. - An authenticated user clicks the link. - Rovo Chat injects the external parameter into the session without any warnings, confirmations, or taint labels. - Rovo searches Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, and other services using the user's permissions and connector permissions. - It retrieves and summarizes sensitive information. Chain B: Automated Exfiltration Using ResearchAgent - The injected prompt starts Rovo's ResearchAgent. - The agent fetches information from internal data sources. - The agent transforms and summarizes the information. - It uses multi-step web browsing and navigation to send the data to an arbitrary website. - Because this completes within a single agent run, it requires no repeated prompts or additional approvals. Targets Confirmed in PoC - Confluence pages - Jira tickets - SharePoint content containing personal information 4. Attacker Position and Execution Location - Attacker: Distributes the crafted URL from the outside and prepares an external web service to receive the data. - User Device: The user clicks the link in a browser. No malware execution is required on the device. - Authentication and Execution Context: The user's existing Atlassian login session. - Data Source Location: Atlassian cloud, plus Microsoft 365, Google Workspace, Slack, etc., accessed via Rovo Connectors. - Automated Execution Location: Cloud-side agent execution in Rovo Chat / ResearchAgent. - Exfiltration Destination: Any external web endpoint reachable by the ResearchAgent. 5. Visibility to Victims and Administrators To the user, the link looks like a normal link to open Atlassian Rovo Chat. It does not require downloading malware, entering credentials, or approving MFA. There is also no explicit warning that the session was seeded with external parameters. To administrators, the activity looks like a normal user identity launching Rovo Chat, searching a wider range of repositories and SaaS platforms than usual, performing multi-step browsing with the ResearchAgent, and making POST requests or navigating to an external site. This makes it easy to confuse with normal AI research activities. 6. Success and Failure Conditions Success Conditions - The user is signed in to Rovo and clicks the crafted link. - Vulnerable behavior where external input in rovoChatPrompt is automatically ingested into the Rovo session. - Rovo and its connectors have broad read permissions to sensitive data sources. - ResearchAgent's browser and multi-step automation features are enabled. - Communication and posting to external destinations are permitted. - Agent activity logs are not monitored. Failure Conditions - Environment patched by Atlassian. - External parameters are displayed and verified as untrusted, preventing automatic execution. - Rovo connectors and user permissions are minimized, leaving highly sensitive areas unconnected. - Unnecessary ResearchAgent, browsing, and multi-step automation features are disabled. - Approvals, allowlists, and DLP (Data Loss Prevention) are applied to external transmissions by agents. - Crafted Rovo URLs are blocked or warned against by email and browser controls. 7. What Happens on Success The attacker does not directly steal the user's password or token. Instead, they hijack the normal permissions delegated to Rovo and use them as a proxy for execution. Jira issues, Confluence pages, SharePoint files, and other data visible to the user are searched and summarized, and then sent outside the organization via the ResearchAgent's external web operations. The more connectors and permissions exist, the wider the blast radius. 8. Observable Logs - Links containing home.atlassian.com/chat androvoChatPrompt - Rovo links that pass through URL shorteners or redirects - Sender, recipient, click telemetry, and delivery time - Since distribution can also happen via chat or web rather than email, the absence of email logs does not mean the user was untouched. Proxy / SWG / DNS - Browser access to crafted Rovo Chat URLs - rovoChatPrompt in URL queries (be careful with the handling of sensitive prompts when storing) - Simultaneous access from Rovo / ResearchAgent to external web endpoints - Traffic spanning multiple SaaS platforms and unknown external domains in a short time Endpoint / EDR - Clicking an Atlassian Rovo link without browser history downloads or malware execution - No malware process is created - Browser extension and EDR URL telemetry are important - Inference: Parent context where the browser was launched from a clipboard, chat client, or email client Identity / IdP - Use of normal user Atlassian session - IP and device during Rovo access may match normal patterns - OAuth scopes, service accounts, and user delegations granted to Rovo and its connectors - The absence of new authentication events or MFA failures is itself a characteristic feature SaaS / Cloud - Rovo Chat session, seeded prompt, and ResearchAgent run - Jira, Confluence, and Bitbucket search and read audits - Connector reads for SharePoint, Microsoft 365, Google Workspace, Slack, etc. - Reads across many sources in a single agent run - ResearchAgent external navigation, uploads, and POST requests Network - Traffic may appear as normal TLS from the user device to Atlassian - Cloud-side agent execution may leave no exfiltration traffic in corporate network logs - Without SaaS audit logs and agent traces, it is difficult to determine an attack based on network logs alone 9. Attack Success Determination - Contact Only: The crafted link was received, but not clicked. - User Action: The link was clicked, and a Rovo Chat session started. - Initial Execution: The external rovoChatPrompt was ingested into the session and processed as agent instructions. - Malware or Successful Authentication: No malware or new authentication is required. The ResearchAgent starts within a legitimate session. - Information Theft / Session Compromise: Internal data reads and transmission to an external endpoint are confirmed within the same agent run. - Follow-on Compromise Confirmation: Credential abuse, phishing, or extortion using the exfiltrated information has not been confirmed in public PoCs. 10. Investigation Playbook Trigger - Clicking a link with rovoChatPrompt - Rovo reading multiple highly sensitive sources in a short time - ResearchAgent navigating to or posting to an unknown external site - Agent runs outside the user's normal business activities Initial Checks - Verify Atlassian patch application and tenant protection status. - Preserve the original link, redirect chain, Rovo Chat session, prompts, and agent traces. - Extract Rovo and connector audit logs around the click time on a per-user basis. - Determine which objects were read, the external destination, and whether a transmission payload exists. Endpoint - Browser history, URL telemetry, referrer, and source application - Confirm the absence of simultaneous downloads or process executions - Search for other users and devices that clicked the same link Authentication and Cloud - Check Atlassian sessions, OAuth connectors, and Rovo scopes. - Retrieve the list of read objects for Jira, Confluence, SharePoint, etc. - Connector token theft has not been confirmed in public materials. Do not assume all tokens are compromised without evidence. - Stop unauthorized agent runs and revoke sessions and connector tokens as needed. Subsequent Actions - Confirm reachability, uploads, and POST requests to external destinations. - Classify the read credentials, secrets, and personal information. - Rotate exposed secrets and monitor for login attempts or phishing using the exfiltrated information. Containment - Temporarily disable Rovo, ResearchAgent, and browsing if vulnerable behavior persists. - Disconnect unnecessary connectors and exclude HR, legal, finance, and IR data from the Rovo scope. - Block external destinations and invalidate the affected agent run and session. - Share information regarding the exposure with affected users, data owners, and privacy/legal teams. Determination Categories - Link Delivered - Link Clicked - External Prompt Accepted - Internal Data Read - ResearchAgent External Action - Data Exfiltration Confirmed - Follow-on Abuse Confirmed 11. Defense and Detection Ideas Single Events - External links containing rovoChatPrompt - External parameters seeded into Rovo Chat - Unauthorized external domain access by ResearchAgent - Unu