AI Security
Just Reading a Document
Can Leak Your Company's Data
No click. No approval. The moment Atlassian's work AI "Rovo" reads a Confluence page carrying one planted sentence, confidential data goes straight out the door. A flaw in Rovo puts the entire "feed it the whole document, let it answer" design under scrutiny.
An attack that fires
just by being read
Security firm PromptArmor reported that Atlassian's work AI agent Rovo (the generative AI layer built into Jira and Confluence) is vulnerable to zero-click data exfiltration. An attacker only needs to plant an instruction inside a Confluence document; the moment Rovo "reads" it, the instruction executes and internal data gets sent externally. Per PromptArmor's report, the attack abuses Rovo's built-in URL retrieval tool and requires no human approval or click whatsoever.
GIGAZINE covered the flaw on August 6, 2026, describing how internal data can be sent externally "just by having Rovo read a document." It's a textbook example of indirect prompt injection — the kind that fires without the victim ever noticing.
Two months of silence
between report and public release
Responsible disclosure was followed — Atlassian's response was slow to match it.
PromptArmor reported the flaw to Atlassian privately on May 23, 2026. Atlassian issued a case number but, per PromptArmor's own account in its report, gave no detailed response for more than two months — leading PromptArmor to publish on August 5. Making matters worse: admins who disable the "web search" feature get less protection than they'd expect. Turning it off removes the visible option from the user interface, but Rovo's underlying URL retrieval tool keeps running, leaving the attack path open.
Why this matters now
It bites precisely because "feed it everything, let it answer" became the default for work AI.
Over the past few years, SaaS work-AI tools have raced to adopt the same design: ingest every document and ticket, then let the AI answer questions across all of it. Confluence meeting notes and Jira tickets became more valuable precisely because AI could read across them freely. What Rovo's case shows is that this exact premise can become the attack surface. The more an AI is designed to read, the more places an attacker can plant an instruction — this isn't a bug specific to one product, it's a structural risk shared by every RAG-style work assistant built the same way.
What's most concerning is that admin-side mitigations don't work as expected. The comfort of "we turned off the risky feature" turned out not to close the actual path — a wake-up call worth applying to every other work-AI product's settings, not just Rovo's.
Who it hits, and how
Engineers / admins
Re-audit Rovo's external URL retrieval and web-search settings. Check logs to confirm a feature marked "disabled" actually closes the path, not just the UI toggle.
Business / PM
Inventory how much confidential material lives in Confluence and Jira. Work with security to confirm exactly what Rovo can read and with what permissions.
Individual users
If you don't use Rovo or a similar enterprise work-AI tool, there's no direct impact. It's still worth remembering as a general caution about any AI designed to ingest whole documents.
What to do next
Audit Rovo's external connectivity settings
Check both the admin console and logs to confirm web-search and URL-retrieval features aren't quietly active behind a "disabled" toggle.
Narrow what Rovo can read
Restrict Rovo's access to spaces and projects to the minimum needed, and exclude confidential documents that were never meant to be externally exposed.
Wait for and apply Atlassian's official fix
No permanent fix was confirmed as of this writing. Have a process ready to apply Atlassian's patch or guidance the moment it ships.
No click required to leak.
Reading it was enough to open the door.
The counter-view, risks, and limits
A few things temper the alarm. As of this writing, there's no confirmed case of this flaw being exploited in the wild — PromptArmor's report demonstrates that the attack is possible, not that it has happened. Atlassian has not yet issued a public statement or fix timeline as of this writing either.
The blast radius is also bounded: the direct risk is small unless your organization runs Rovo across Confluence and Jira with confidential material concentrated there. Still, since "feed it everything, let it answer" is becoming the industry default for work AI, any organization running a similar assistant — not just Rovo customers — has good reason to review its own settings rather than treat this as someone else's problem.