On August 7, 2026 Dolev Taler of Varonis Threat Labs published RovoBlast, a vulnerability in Atlassian’s Rovo AI assistant. Rovo Chat accepted a URL parameter named rovoChatPrompt without validation, so a link of the form home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=ATTACKER_TEXT would surface attacker-supplied text directly inside the victim’s own authenticated Rovo session. One click was the whole delivery mechanism.
What made a single injected prompt serious was the assistant’s reach. Rovo connects through Rovo Connectors to Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, databases and more than fifty further services, and the injected instructions inherit whatever the signed-in user is permitted to see. Rovo’s ResearchAgent then supplies the outbound leg: it can perform deep multi-source research and multi-step browsing across arbitrary websites on its own, so data could be carried out without any further interaction from the victim.
Varonis reports that the issue was discovered in January 2026, reported to Atlassian through its Bugcrowd programme, and has been fixed. The writeup presents no evidence of exploitation in the wild, and the findings were debuted publicly at DEF CON 34. Read fairly, this is a responsibly disclosed and remediated flaw rather than a breach with known victims.
The pattern is the one that keeps recurring in agentic products: a parameter that was designed as a convenience for deep-linking into a chat becomes an untrusted instruction channel, and an autonomous browsing tool becomes the exfiltration path. For anyone deploying an enterprise AI assistant, the two questions this raises are concrete. First, can any URL, document or ticket place text into a session that the model will treat as instructions. Second, does the assistant have an outbound capability that can move data to a destination the attacker chooses. If both answers are yes, the connector inventory is the real blast radius, and it should be scoped deliberately rather than accepted as a default.