"Rovo's guardrails around untrusted prompts [are] almost non-existent," Varonis Threat Labs wrote in its analysis — a finding that underpins a single-click chain of actions researchers say could seed and exfiltrate corporate data from Atlassian's enterprise AI assistant.
The URL parameter: Parameter-to-Prompt in Rovo
Varonis disclosed a flaw it named RovoBlast after presenting research at DEF CON 34 and publishing its analysis on August 7. The vulnerability stemmed from Rovo accepting a URL parameter that pre-filled the assistant's chat entry, a pattern Varonis calls Parameter-to-Prompt. That single crafted link could surface attacker-controlled text directly into an authenticated user's session.
Because the victim's session was already present in the browser, Varonis observed, a click was sufficient to seed the assistant. No warning appeared, no confirmation was requested, and nothing marked the session as having been seeded from an external parameter. The organization identifier in the path could be left empty; Atlassian redirected the request into the user's default organization, widening the range of possible targets.
ResearchAgent: the assistant's built-in exit
Turning a seeded prompt into data leakage required an outbound capability, and Varonis found one already present. Rovo's ResearchAgent performs multi-source open-web research and can browse and navigate arbitrary websites across multiple steps autonomously. That agent could be instructed — via the Parameter-to-Prompt vector — to retrieve internal content, transform it, then post the results somewhere externally reachable.
Varonis highlighted how chaining those steps inside one agent run reduced the number of user-facing interactions. An audit trail produced by such an agent run could resemble ordinary research activity rather than an obvious exfiltration attempt, complicating detection and forensic review.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadIntegrations, access breadth, and persistence
Rovo functions as an AI layer across Jira, Confluence and Bitbucket, and reaches into connected services including Slack, Microsoft 365 and Google Workspace. The assistant could also enumerate relational databases, uploaded files, web pages and archives, and Atlassian's connector catalogue supports more than 50 platforms. That range of access provided the source material ResearchAgent could harvest.
Compounding the exposure, Varonis noted, Rovo cannot be fully removed from an Atlassian environment. That means organizations cannot eliminate the attack surface by uninstalling the assistant outright — a structural constraint that leaves the capability present unless its reach and features are actively limited.
Varonis' recommendations for defenders
Varonis advised defensive steps that map directly to the observed attack chain. Its guidance included shrinking what the assistant can reach by disconnecting unused integrations and keeping legal, HR, finance and incident-response content out of scope entirely. Where teams do not rely on browsing agents and multi-step automation, Varonis recommended disabling those features.
Operational measures included reviewing assistant logs, alerting on unusual agent runs, and periodically testing how an environment responds to seeded prompts. Those controls aim to raise the cost of exploitation and make the kind of low-interaction chaining Varonis demonstrated easier to spot.
What this means for security teams, procurement leaders, and end users
- Security teams: The attack chain combines a public surface (a crafted URL) with an authenticated session and an autonomous browsing agent. Teams will need to treat assistant integrations and agents as data-flow vectors, reviewing connector scopes, agent permissions, and audit trails for multi-step runs.
- Procurement and enterprise IT leaders: Because Rovo's connector catalogue spans more than 50 platforms and the assistant cannot be fully removed, procurement choices and contract language about configurable limits and agent controls will matter. Organizations should insist on the ability to disable browsing agents or to narrowly scope connector access.
- End users: A single click could seed an assistant with external instructions without visible cues. Users who work in environments with sensitive legal, HR, finance or incident-response materials should be particularly cautious about clicking links while authenticated to enterprise collaboration and development platforms.
Varonis disclosed RovoBlast to Atlassian and published the analysis on August 7; Atlassian has since fixed the flaw. The chain Varonis documented — a Parameter-to-Prompt link, an authenticated session, and the ResearchAgent's autonomous browsing and posting — serves as a reminder that convenience features can create compact, high-impact paths for data to leave an environment. The fix addresses the immediate flaw, but the broader lesson is structural: assistants that accept external parameters and operate multi-step browsing agents create attack patterns that defenders must identify, limit and monitor.