PERMISSION/PROTOCOL
Back to incident tracker

2026-08-09

HighPrimary

RovoBlast: One-Click Prompt Injection in Atlassian Rovo Exfiltrates Enterprise Bitbucket, Jira, and Slack Data

Analysis of the RovoBlast vulnerability presented at DEF CON 2026, where a crafted URL parameter pre-seeds prompt injection in Atlassian Rovo.

Atlassian RovoGovernance bypassURL Parameter-based Indirect Prompt InjectionEnterprise collaboration platform / Atlassian Cloud

What happened

The victim clicks a crafted Atlassian link; the Rovo agent reads the URL parameter, interprets it as system instructions, and initiates Confluence scans.

Why it matters

Mass exfiltration of internal company documents, active source code repositories, and team messaging channels.

Missing authorization check

Outbound data transmission from enterprise databases must require an out-of-band, human-signed cryptographic receipt.

Would PP block it?

When the hijacked Atlassian Rovo agent attempts to package and exfiltrate Confluence page contents or Jira ticket databases, the outbound API request is intercepted by PP's Tool-Call Gate. Since the transfer is triggered autonomously by the pre-seeded prompt injection and lacks a cryptographically-signed human authorization receipt, the exfiltration call is rejected, fail-closing the data leak.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-08-09

    Varonis Threat Labs presents RovoBlast at DEF CON 2026, showing 100% exploit rate on unpatched instances.

  2. 2026-08-09

    Atlassian completes deployment of hotfixes validating URL-passed chat prompt parameters.

Technical breakdown

  • The attacker constructs a URL pointing to Atlassian Cloud containing the `rovoChatPrompt` query string.
  • The victim clicks the link, initiating a chat session. Rovo's backend parses the parameter, inserting it with system-prompt authority.
  • The ResearchAgent executes the injected instructions, scanning Bitbucket repositories for API tokens and sending them to the attacker's server.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Tool-Call Gate, out-of-band API proxy boundaries
Still needs
PP does not prevent the agent from performing read-only queries within Atlassian's internal databases.
Receipt required for
Exfiltrating database records, transmitting file contents to external hosts, or invoking external webhook URLs

PP's Tool-Call Gate intercepts and blocks any high-volume or sensitive external data exfiltration actions that lack matching user-signed receipts.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop