Atlassian Rovo AI Vulnerability Lets Attackers Steal Enterprise Data With a Single Click

Gbhackers •Divya • August 10, 2026

RovoBlast is a recently disclosed vulnerability affecting Atlassian’s Rovo AI assistant that allows attackers to expose sensitive enterprise data through a single malicious link. According to Varonis Threat Labs, the vulnerability exploits Rovo’s handling of URL-supplied prompts, enabling attackers to inject malicious instructions into an authenticated user’s AI session. The attack does not require traditional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RovoBlast Vulnerability Exposes Enterprise Data via One-Click Attack Atlassian's Rovo AI assistant was found vulnerable to a one-click prompt injection attack, dubbed RovoBlast, which allows attackers to inject malicious instructions into authenticated user sessions. This vulnerability was disclosed by Varonis Threat Labs at DEF CON 34 and affects Rovo's integration with services like Jira, Confluence, and Slack. The attack can exfiltrate sensitive data without user approval, as Rovo's browsing agent autonomously retrieves and posts internal content externally. The flaw was reported to Atlassian, which has since deployed a fix on July 8, 2026. However, Rovo's inability to be fully uninstalled means organizations still face risks. Researchers recommend limiting Rovo's access and monitoring its activity to mitigate potential threats. 4 sources 71

Extracted Entities

Atlassian Rovo AI Vulnerability Lets Attackers Steal Enterprise Data With a Single Click

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (2)

Platforms (1)