Varonis Threat Labs disclosed a critical one-click vulnerability in Atlassian’s Rovo AI assistant at DEF CON 34 on August 8, revealing that a single crafted link could hijack a user’s live AI session and exfiltrate sensitive enterprise data. Atlassian patched the flaw before publication, but the attack required no jailbreak and no permission bypass to execute successfully.
The vulnerability, dubbed RovoBlast, exploited a URL parameter called rovoChatPrompt that pre-fills content directly into Rovo’s chat window without any user-facing warning. Varonis researchers discovered that attackers could leave the organization ID portion of the URL completely blank, and Atlassian would still route the request into the victim’s default organization. Once a victim clicked the attacker’s link, the system seeded malicious instructions straight into their active session as trusted input.
The attack surface was enormous because of what Rovo can actually access across a typical enterprise deployment. When researchers simply asked the AI what data it could see, the response included Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files, web pages, and archived content. That breadth of access turned a simple parameter injection into a gateway to virtually everything an organization stores.
Actual data exfiltration relied on ResearchAgent, one of Rovo’s built-in autonomous tools that can conduct multi-source web research and navigate arbitrary sites without further user involvement. Once the attacker’s prompt landed through the malicious link, ResearchAgent pulled internal data and pushed it to an external destination in a single automated chain. Varonis demonstrated this across three separate proof-of-concept scenarios, successfully stealing Confluence pages, Jira tickets, and SharePoint content containing personal data.
The technique required no chaining of multiple requests and no additional bypass steps beyond the initial click to succeed. A single seeded link was generally enough to trigger the full leak from discovery through exfiltration in one automated sequence. Varonis classifies this attack path as parameter-to-prompt injection, the same category they previously reported in Microsoft Copilot under the name Reprompt back in January 2026.
Atlassian acknowledged the vulnerability and said it is working with customers to implement protective controls on their instances. However, the company’s statement placed significant responsibility on users, recommending they “verify that any content provided to their Atlassian apps comes from a trusted source.” The framing drew criticism because the entire point of the attack is that victims cannot distinguish a malicious RovoBlast link from a legitimate one.
As the report puts it:
What RovoBlast exposes is not just a prompt injection flaw but a trust gap at the heart of enterprise AI. Organizations are racing to connect AI systems to more data to drive productivity, but every new connection increases the blast radius when something goes wrong.
Rovo didn’t expose this risk recklessly. It did so because it operates deeply inside the enterprise trust boundary, with access, identity, and autonomy by default. In that environment, a single misclassified input can quietly turn productivity into data exposure.
Reprompt first showed this risk in consumer AI. RovoBlast shows how much higher the stakes are when the same patterns move into the enterprise.
Varonis recommends that organizations limit which systems Rovo can reach, disconnect unused integrations, and wall off sensitive areas such as legal, HR, and finance from AI assistant access entirely. The researchers also advise organizations to disable browsing and multi-step automation features they aren’t actively using, and to monitor assistant activity logs routinely for anomalous data access patterns before they escalate
