A new disclosure from Varonis Threat Labs highlights a serious risk for organizations using AI assistants that can connect to workplace systems. The issue, known as the RovoBlast AI vulnerability, allows a specially crafted link to seed attacker-controlled instructions directly into a victim’s active Rovo AI session—potentially leading to the disclosure of enterprise data.
What makes the scenario especially concerning is that it was demonstrated as a one-click style attack path. The researchers report that it does not rely on jailbreak techniques or permission bypasses, but instead abuses how Rovo handles externally supplied inputs.
What is the RovoBlast AI vulnerability?
Rovo is Atlassian’s enterprise AI assistant designed to operate across connected tools. It acts as an AI layer spanning Jira, Confluence, Bitbucket, and third-party services such as Slack, Microsoft 365, and Google Workspace. In addition to chat-style responses, it can run autonomous agent features that complete multi-step tasks.
According to the disclosure, RovoBlast takes advantage of that automation capability. The assistant can treat externally provided parameters as trusted input, so an attacker can influence what the AI does once a user opens a malicious link.
How the one-click link seeds attacker instructions
The researchers describe an attack path they call parameter-to-prompt (P2P) injection. In this case, the key enabler is a URL parameter named rovoChatPrompt, which pre-fills content in Rovo’s chat window.
In other words, the attacker supplies content that the assistant effectively accepts as part of the conversation. Because Rovo then proceeds as if the prompt is legitimate, the injected instructions can steer the assistant’s behavior during the session.
Varonis also notes a routing detail that helps the attacker make the request without obvious friction: the organization ID portion of the URL could be left blank, and Atlassian would still route the request into the victim’s own default organization. The researchers report no warning or indicator that the session had been seeded by an outside source.
The role of Rovo’s autonomous tools
The potential impact goes beyond a single chat response. The leakage centers on ResearchAgent, a built-in capability within Rovo that can autonomously perform multi-source web research and navigate across arbitrary sites.
Once the malicious prompt is seeded through the link, that same agent functionality enables an automated chain: Rovo can retrieve internal information available to the session and then package and send results outward.
Varonis emphasizes that the demonstration did not require chaining multiple requests or additional bypass steps. In their tests, a single seeded link was generally enough to trigger the data exposure.
What kinds of data were exposed?
To estimate the “blast radius,” the researchers asked Rovo what data it could access. The assistant’s output referenced a broad set of enterprise sources and content types, including:
- Jira, Confluence, and Bitbucket
- Slack and Google Workspace
- Microsoft 365
- Relational databases
- Uploaded files
- Web pages
- Archived content
Varonis reports that the proof-of-concept scenarios specifically demonstrated exfiltration of:
- Confluence pages
- Jira tickets
- SharePoint content containing personal data
These examples show how a prompt-injection style trigger can lead to retrieval and summarization of sensitive organizational information when AI agents are allowed to reach multiple systems.
Why this matters for enterprise AI assistants
Rovo’s value comes from its ability to connect to everyday work platforms and assist with multi-step tasks. The RovoBlast AI vulnerability demonstrates a common tension in modern AI assistance: when an assistant is powerful enough to use connected tools, the same capabilities can amplify the consequences of prompt injection.
Notably, Atlassian’s spokesperson described this class of attack as one that affects AI systems across the industry, similar in spirit to phishing approaches. The key takeaway is that even without a direct “exploit” in the traditional sense, untrusted content that influences an AI assistant can still drive harmful outcomes.
Mitigations organizations can take now
Varonis shared several recommendations for reducing risk. Because RovoBlast depends on the assistant reaching accessible systems and executing agent behavior, the most effective controls focus on limiting what the assistant can access and what automation it can run.
Key guidance includes:
- Limit which systems Rovo can reach, reducing the number of connected sources that could be queried.
- Disconnect unused integrations so there are fewer pathways for data retrieval.
- Wall off sensitive areas such as legal, HR, and finance from assistant access.
- Disable browsing or multi-step automation features that are not actively needed.
- Monitor assistant activity logs and regularly review assistant behavior for suspicious activity.
Atlassian also indicated that customers should follow security best practices and verify that content provided to Atlassian apps comes from trusted sources—positioning prompt seeding as a risk that can resemble social engineering.
Disclosure and remediation status
Varonis reported the vulnerability to Atlassian. The company fixed the issue before the findings were published, according to the disclosure. In addition, the research was presented at DEF CON 34 by Varonis Threat Labs, and a technical write-up is available on the Varonis blog.
Even with a fix in place, the underlying lesson remains important: AI assistants that accept externally influenced prompts and can autonomously act across connected enterprise systems need layered protections, not only patching.
Practical next steps for teams using Rovo
If your organization uses Rovo or similar assistant features, consider taking a short review pass on configuration and monitoring:
- Confirm that the relevant security update has been applied to your Atlassian instances.
- Audit every integration Rovo can access and remove those that are not required.
- Restrict access to sensitive categories of information, particularly content containing personal data.
- Reevaluate whether browsing and autonomous multi-step automation are necessary for every user and use case.
- Ensure assistant activity logs are collected centrally so suspicious assistant behavior is visible quickly.
By combining timely updates with careful access control and monitoring, you reduce the likelihood that a seeded prompt can turn into an automated data disclosure.
Conclusion
The RovoBlast AI vulnerability underscores a key challenge in enterprise AI: when assistants can connect to real systems and run agent workflows, untrusted input can have amplified impact. Varonis demonstrates how a crafted one-click link can seed instructions into an active Rovo chat session, then leverage autonomous research capabilities to retrieve and potentially expose sensitive internal data.
The most effective response is layered risk reduction—limit assistant reach, disable unused automation, segment sensitive areas, and monitor activity—so that even if prompt injection attempts occur, the blast radius stays small.
