Atlassian's AI Agent Has a Data Leak Nobody's Fixed Yet

Security firm PromptArmor just published a disclosure showing how Atlassian's Rovo — the AI agent baked into Jira, Confluence, and the rest of Atlassian's suite — can be tricked into exfiltrating whatever data it has access to. No password theft, no exploit chain, no malware. Just a cleverly worded file upload.

Here's the part that should worry anyone running AI agents inside their company tools: Atlassian was told about this in May. It's still broken.

How the Attack Actually Works

The exploit doesn't need much. It runs in five steps:

1. A user asks Rovo a completely ordinary question.
2. The user (unknowingly, if this were a real attack) uploads a file that contains hidden instructions buried in its content.
3. Rovo processes the request and, in doing so, reaches into internal systems — Jira tickets, Confluence pages, whatever it's connected to.
4. The hidden instructions hijack that access, telling Rovo to tack sensitive data onto a URL controlled by the attacker.
5. Rovo dutifully opens that URL to "check" it — and the attacker's server logs everything that came along for the ride.

That's a textbook indirect prompt injection: the malicious instructions never come from the attacker directly, they're smuggled in through content the agent is asked to process. The agent can't tell the difference between "the user's request" and "instructions hiding inside a file the user handed it."

The Kill Switch Doesn't Actually Kill It

The more alarming detail is what happens when you try to turn this off. Atlassian lets admins disable Rovo's web search feature — which sounds like it should close this hole. It doesn't. PromptArmor found that disabling web search removes the search tool but leaves the URL-opening tool intact, which is the actual piece the exploit depends on. Turning off the feature that looks relevant does nothing, because the vulnerable capability was never tied to that toggle in the first place.

Real Data, Real Exposure

This isn't a hypothetical. Anything Rovo can see is fair game: Jira tickets, Confluence documents, and data pulled in through any third-party connector the organization has wired up. For a tool that's specifically designed to have broad access across a company's knowledge base — that's the whole value proposition of Rovo — the blast radius is basically "everything."

PromptArmor says it disclosed the issue on May 23, 2026. Atlassian acknowledged the report, then went quiet through multiple follow-ups. As of this week's publication, the system is still unpatched.

Why This Keeps Happening

This is the third or fourth version of the same story this year: an AI agent gets wired into real company systems for legitimate productivity reasons, and nobody fully accounts for the fact that the agent can't distinguish "trusted user intent" from "text that happened to arrive in its context window." Give an agent broad read access and an unrestricted way to make outbound requests, and you've built a leak, whether or not anyone ever tries to exploit it.

The fix isn't "don't use AI agents." It's treating tool access the way you'd treat any other privileged system integration — scoped tightly, with outbound actions that require confirmation rather than running silently in the background.

What this means if you use OpenClaw

This is the exact failure mode OpenClaw is built to avoid. Your agent only reaches the tools you've explicitly connected, and actions with real consequences — sending data somewhere, hitting an external URL, touching a connected system — go through your confirmation rather than executing automatically because a piece of uploaded content told it to.

The Rovo disclosure is a good reminder of what "AI agent with broad access" looks like when the guardrails are an afterthought instead of the design. An agent that can silently open any URL it constructs, with access to your entire knowledge base, is a data leak waiting for someone to write the right prompt.

The Bigger Picture

Companies are racing to wire AI agents into their most sensitive internal tools, and the security model hasn't caught up. A three-month-old, unpatched, publicly disclosed vulnerability in a major vendor's flagship AI product is a sign of how far behind that catch-up still is. The agents worth trusting with your data are the ones where "can this be exfiltrated by a hidden instruction in a file" was answered before launch, not after a researcher had to publish it to get a response.

Start your free trial →