Enterprise IT teams and security operations centers are reviewing access permissions across Atlassian cloud environments after security researchers disclosed an indirect prompt injection vulnerability in Atlassian Rovo, the company’s AI-powered organizational assistant. Disclosed on August 8, 2026, the vulnerability enables unauthorized attackers to exfiltrate confidential data from Jira tickets and Confluence workspaces.

Deconstructing the AI Indirect Prompt Injection Attack

Atlassian Rovo integrates deeply across enterprise Atlassian products to synthesize team knowledge, answer internal queries, and automate workflow actions. However, security researchers demonstrated that untrusted text embedded within public or external Jira issues and Confluence pages could hijack Rovo’s underlying LLM execution context.

When an employee interacts with the AI assistant or asks Rovo to summarize a project board containing crafted malicious prompts, the hidden instructions override Rovo’s system guardrails. Without requiring user authorization, the compromised AI agent can silently extract sensitive internal documentation, API keys, and customer data from connected Jira and Confluence repositories, transmitting the stolen payload to attacker-controlled external endpoints.

Essential Safeguards for Enterprise AI Integrations

As organizations accelerate the adoption of agentic AI assistants across collaborative enterprise tools, security teams should implement several critical risk controls:

• Implement Strict Egress Controls on AI Agents: Enforce Zero Trust data loss prevention (DLP) rules that restrict enterprise AI assistants from establishing outbound connections to unvetted external domains.
• Enforce Least-Privilege Data Scoping: Restrict AI assistant indexing permissions to prevent non-public or sensitive repositories from being indexed by automated workspace assistants.
• Input & Context Sanitization: Apply robust indirect prompt injection filters to inspect incoming external ticket descriptions and user comments before passing content to internal LLM contexts.

Source: The Hacker News