Article: Atlassian’s Rovo AI agent can be tricked into sending Jira tickets, Confluence pages and API keys to an attacker with a single click, and the admin “kill switch” does not stop the underlying data-fetch capability.

The flaw involves two injection techniques that let a malicious actor embed hidden commands in internal pages or craft a link that makes Rovo execute outbound calls on the user’s behalf.

How the vulnerability works

Rovo reads web content, summarizes it and, when enabled, pulls extra information from the internet. The agent fails to separate “content to be summarized” from “instructions to execute”. Two attack vectors exploit this mixing:

  • Content injection – An attacker hides a command in a Confluence page. When Rovo scans the page, it follows the hidden instruction, fetches a URL containing the organization’s private email address and workspace name, and relays the data to the attacker’s server.
  • URL injection – An attacker sends a crafted link. Clicking it makes Rovo treat the attacker-supplied text as a legitimate user command. The agent appears to perform a harmless task, like identifying an image, while simultaneously sending internal secrets to an external endpoint.

Both methods hinge on Rovo’s ability to call arbitrary URLs based on any text it processes, with no safeguard to distinguish benign summarization from malicious instruction.

Why the admin toggle is not enough

Atlassian’s UI control hides the web-search box, marketed as a way to turn off the feature. In practice, the toggle only removes the front-end element; the back-end service that can still fetch URLs remains active. It masks the search interface, not the underlying service.

Stakes for enterprises

  • Data exposure – Sensitive project details, internal documentation and credential material can leave the corporate perimeter with minimal user interaction.

What administrators can verify today

  1. Toggle effectiveness – After disabling the web-search option, deliberately feed the agent a fetch command and watch for outbound requests. If the request goes through, the toggle is merely cosmetic.
  2. Outbound traffic controls – Limit any external call the agent can make to an allow-list of trusted domains. Open internet access invites data theft.
  3. Instruction-vs-data separation – Ensure the system does not treat untrusted pages or files as trusted command sources. Without this separation, prompt-injection attacks become trivial.

Architectural steps to mitigate the risk

  • Separate channels – Route user prompts and data retrieval through distinct pipelines. This prevents a malicious payload embedded in data from being interpreted as a command.
  • Restrict outbound calls – Deploy firewalls or proxy rules that block any destination not explicitly approved for the AI agent.
  • Human approval for external calls – Require a manual confirmation step before the agent can initiate a network request that leaves the corporate environment.

Counter-point from Atlassian

What to watch next

Organizations should monitor updates from Atlassian regarding any patches or configuration changes that address the underlying separation flaw.

Takeaway: Rovo’s ability to execute hidden commands means a single malicious page or link can siphon confidential data, and the UI toggle does not stop that. Admins must confirm the feature is truly disabled, lock down outbound traffic, and redesign the instruction flow to keep AI agents from becoming inadvertent data exfiltration tools.