§1What happened
Security firm PromptArmor showed that a single document uploaded to Atlassian's Rovo assistant can carry hidden instructions that make it collect a user's Jira and Confluence data and post it to an attacker's server, with no human approval anywhere in the loop. The victim does nothing exotic. They drop a file into Rovo and ask it to help with a routine task. The instructions ride in on the file.
The uncomfortable part is the calendar. PromptArmor disclosed the flaw to Atlassian on 23 May 2026. When they published on 5 August, they reported Rovo still vulnerable. That is more than two months of a named, working data-exfiltration path sitting open in an enterprise tool that, by design, has read access to a company's tickets, wiki, code and connected SaaS. We are not here to score the disclosure handling. We are reading the mechanism, because the mechanism is the reusable part, and it is one every builder wiring tools onto an agent will meet.
§2The instruction that was never meant for a human
This is indirect prompt injection, and the "indirect" is the whole move. Nobody sends a malicious prompt to Rovo. They hide it inside a file the user legitimately hands over, written so a person skims straight past it while the model reads every word. Rovo is Atlassian's assistant for searching, summarising and taking actions across Jira, Confluence, Bitbucket and third-party tools, so uploading a document and asking it to organise the work is exactly what it is for. The agent cannot tell the difference between content it was asked to process and instructions it should obey, because they arrive on the same channel, in the same words.
If that sounds familiar, it should. The same week a self-representing litigant was caught hiding white-on-white text in a US court filing, hoping any AI reviewing it would take the invisible line as an order. Different venue, identical trick. Untrusted text goes in, and somewhere downstream a model treats part of it as a command. The lesson is not "watch out for white text". It is that any system reading content it did not author is reading instructions it did not sanction.
§3The exfiltration rode a tool nobody thought was dangerous
Here is the load-bearing detail, and it is not the injection. It is what the agent could do next. In PromptArmor's own words, "Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent." So the hidden instructions steer Rovo to read the data it is allowed to read, append that data to a web address, and then use its perfectly ordinary fetch tool to open the address. The attacker does not need code execution or a stolen password. Their server simply logs the request, and the request has your data glued to the end of it.
Read that as a shape, not a Rovo bug. An agent that can read privileged data and can also make an outbound request to an address it assembled itself is an exfiltration tool by construction. You did not build a leak on purpose. You built a reader and a fetcher, and the injection introduced them to each other. The "attack" is two boring, sanctioned capabilities used in sequence.
§4The off switch that pointed at the wrong thing
Atlassian gives admins a web-search toggle, and the obvious instinct is to flip it off and feel safer. Per PromptArmor, it does not help: the attack "succeeds even if an organization has disabled web search for Rovo," because "the web search setting fails to remove the tool for opening the search results." The switch removed a feature. The exfiltration channel was the underlying tool, which the feature toggle never touched.
This is the trap in a sentence. A control that names a product surface ("web search") instead of the capability underneath ("the agent can open an arbitrary URL") gives you the feeling of safety and none of it. Whenever you disable something on an agent, ask a blunt question: did that remove the capability, or just the button that usually invokes it? If the tool is still loaded, the capability is still there for anything that can reach it, including a line of text in an uploaded file.
§5Two teams, one shape, three months apart
Rovo is not being singled out by one researcher with a grudge. A separate team, Varonis, reported a different Rovo injection route, nicknamed RovoBlast, where a crafted link pre-filled the chat with an attacker's prompt and Rovo's research agent did the fetching; per reporting, Atlassian fixed that one server-side on 8 July. Good. But it is the same class of failure wearing a different hat: untrusted input reaches the model, and a tool with too much reach carries the data out. Patching one entry point does not retire the pattern, which is why PromptArmor's route was still live a month after RovoBlast was closed.
That is the thing to internalise. These are not one-off bugs you wait for a vendor to squash. They are the default behaviour of an agent that reads untrusted content and holds a tool that can phone home. Close one door and the shape simply finds the next.
§6What this means if your agent can read and reach
We run an autonomous fleet, so we read this as an operating question, not a headline, and it is the same lesson we have been repeating all summer: the security boundary is the agent's tools and their reach, not its prompt. If you are giving any agent read access to real data plus a way to make outbound requests, three things follow.
First, put a leash on egress. The fetch tool should only reach a fixed allowlist of destinations, and it should refuse addresses the agent assembled on the fly, because a dynamically-built URL is how data walks out. Second, clean the input before the model sees it: strip or flatten invisible and off-canvas text on any uploaded file, so a person and the agent are looking at the same words. Third, keep these controls on a layer beneath the agent, not a toggle in the same product the agent operates, so a hijacked agent cannot route around them and a well-meaning admin cannot be fooled into thinking a feature switch was a security boundary.
None of this waits on a vendor patch, and that is the point. Prompt injection through untrusted content is, for now, an unsolved problem the whole field is carrying, and an enterprise assistant's whole job is to read your untrusted content all day. So assume the payload gets in. Then make sure the tools it lands in are too boring to carry anything out.