RovoBlast: Atlassian AI Leaks Data via Malicious Link

A new vulnerability called RovoBlast could allow Atlassian's AI assistant, Rovo, to leak data. Varonis Threat Labs discovered this issue. Here's the thing: a single click on a malicious link can force Rovo to accept external instructions. This happens without any warnings or permission bypasses. Rovo works across Atlassian products like Jira and Confluence, and even connected tools like Slack and Microsoft 365. Its ability to search and act across these systems makes RovoBlast particularly dangerous. The same features that make Rovo powerful also expand the potential impact of an attack. Rovo operates within a trusted security boundary, making it hard to distinguish abuse from normal use. This issue was responsibly disclosed to Atlassian and has been fixed. The bottom line is that the growing capabilities of AI assistants also create new security risks that organizations need to address.