Atlassian Rovo Leaks Data Even With Web Search Off

Atlassian's Rovo — the AI agent now bundled into paid Cloud plans and wired across Jira, Confluence, and the rest of the suite — can be talked into shipping your tenant's data to a stranger. That's the claim in a report from PromptArmor, and the ugly detail isn't the exfiltration itself. It's that the one admin control most teams would reach for to stop it — disabling web search org-wide — doesn't.

Anyone who switched Rovo on and assumed that toggle was a fence should read this twice.

The attack, start to finish

The setup is mundane. A user asks Rovo to do something boring and legitimate — "clean up and organize these Jira tickets" — and, in the same breath, uploads a file. The file carries hidden instructions. Rovo, doing exactly what it's built to do, fans out across Jira and Confluence to gather context. Sitting in that context is the attacker's payload, and Rovo reads it as gospel.

The injected prompt tells Rovo to grab sensitive content it can already see, splice it into a URL pointed at an attacker's server, and open that URL. Rovo obliges. The attacker reads the smuggled data straight out of their own web server logs. A backup channel uses markdown image rendering — the same trick that's bled data out of half the AI assistants shipped in the last two years.

No malware. No stolen credentials. The victim's own account, running on the victim's own permissions, hands the data over. Anything Rovo can read — tickets, docs, whatever's reachable through connectors — is in scope.

Why the off switch doesn't help

Here's the part worth dwelling on. Atlassian lets admins disable web search for Rovo, and a reasonable person reads that as "Rovo no longer talks to the internet." It doesn't mean that.

Per PromptArmor, killing web search removes the search capability but leaves in place the tool that opens a result URL. Rovo will still fetch a link — including one it just assembled from your data on an attacker's instructions — because nothing checks whether that URL was constructed dynamically mid-conversation. The control admins were handed governs the wrong layer. It closes the front door and leaves a window open with a data pipe running through it.

This is the "lethal trifecta" — Simon Willison's name for the combination that makes agentic AI dangerous — made concrete: access to private data, exposure to untrusted content, and a way to send data out. Rovo has all three, and disabling web search only pretends to remove the third. As long as Rovo can dereference a URL it built itself, the exfiltration channel stays open.

We have seen this movie before

None of the individual moves here are novel, and that's the point. Indirect prompt injection plus an outbound rendering primitive is now the standard exfiltration recipe against enterprise AI copilots.

Microsoft lived it in June 2025 with EchoLeak (CVE-2025-32711), a zero-click flaw in 365 Copilot rated CVSS 9.3: a single crafted email planted instructions that Copilot dutifully followed, exfiltrating context through markdown images and links, using Microsoft's own allowlisted domains to slip past content-security controls. PromptArmor itself demonstrated the same class against Slack AI back in 2024. Different vendor, same three ingredients every time.

Rovo has already been hit repeatedly. An independent researcher found indirect prompt injection through Confluence page summaries; a separate one-click vector abused a rovoChatPrompt URL parameter to preload a malicious prompt into a victim's chat. Atlassian patched both server-side. That history is exactly what makes this report damning — Atlassian keeps swatting individual vectors while the architecture that spawns them stays put. According to PromptArmor's timeline, this bug was disclosed on May 23, acknowledged two days later, and then met silence through two follow-ups; as of publication it remains live. Two-plus months on a critical exfiltration path is a choice.

(One caveat worth stating plainly: the "still unpatched today" status rests on PromptArmor's account, since Atlassian has not commented publicly. The vulnerability class, though, is corroborated across independent researchers and vendors.)

What Rovo admins should actually do

Start by deleting one belief: the web-search toggle is not a mitigation. If your threat model assumed it was, rebuild it.

Then map the real blast radius. Rovo's reach equals everything the invoking user can read across the tenant plus every connected system — so the exposure of a single tricked query is the union of one user's permissions, not one document. Scope Rovo's connectors and the spaces and projects it can touch as tightly as the work actually requires.

Next, treat untrusted content as the injection surface it is. Jira Service Management tickets filed by external reporters, shared or public Confluence spaces, uploaded files, comment threads — anywhere an outsider can place text that Rovo might later read is an entry point. If your tenant ingests external input and also runs Rovo over it, you've built the attack for the adversary.

Don't reach for your network egress controls to save you, either. The fetch originates from Atlassian's infrastructure, not your network, and the data lands in the attacker's logs rather than crossing your proxy. Your firewall never sees it.

While there's no patch, the honest posture is compensating controls: shrink Rovo's data access, keep it away from tenants that process untrusted external content, and watch for anomalous agent behavior. The real fix belongs to Atlassian, and the industry already knows its shape — an egress allowlist for URL fetches, no auto-dereferencing of agent-constructed URLs, no auto-rendering of images from untrusted content, and a human in the loop before anything leaves the tenant.

The judgement

Rovo isn't uniquely broken. It's typical — and that's the indictment. In 2026 the default posture for an agentic assistant with broad read access is exploitable, and the headline safety control a vendor ships can be security theater. The specific failure here is worse than a missing patch: Atlassian gave admins a switch that looks like protection and isn't. Until egress controls land, treat Rovo's read scope as its breach scope, and shrink it accordingly.