RovoBlast Turned a URL Parameter Into a Prompt, and Rovo Ran It

A crafted link seeded attacker instructions into a signed-in Atlassian AI session with no jailbreak, no permission bypass, and no warning. The pattern has a name, at least ten documented cousins, and probably a version of it in whatever assistant your company just rolled out.

Atlassian's Rovo accepted a URL parameter called rovoChatPrompt. Whatever text you put in that parameter got surfaced straight into the chat entry of whoever opened the link, inside their own authenticated session, against their own organization's data.

The part worth sitting with is not the parameter. Pre-filled prompts in a share link are a reasonable product feature, and half the assistants on the market have one. The part worth sitting with is what the parameter did not carry: any marker saying this text arrived from outside. Varonis Threat Labs, who found it and named it RovoBlast, put it plainly in their write-up. No warning, no confirmation, and no taint label indicating the session had been seeded by an external parameter.

Researcher Dolev Taler disclosed it to Atlassian through Bugcrowd, Atlassian fixed the reported path before publication, and the research debuted at DEF CON 34. So that particular door is shut. The shape of it is not, and the shape is the reason to care.

Prompt injection stopped needing a jailbreak

We have spent two years talking about prompt injection as a content problem. Poisoned documents, hostile web pages, adversarial comments buried in a Jira ticket, all of it framed as the model being tricked into reading instructions it should have treated as data.

RovoBlast is a different and more boring failure. Nothing tricked the model. The application handed the model attacker-supplied text through a documented entry point and told it, structurally, that this was the user talking.

Varonis calls the pattern Parameter-to-Prompt, and they found it before. In January they published Reprompt, the same primitive in Microsoft Copilot Personal, riding a q parameter. Varonis was careful there to say Microsoft 365 Copilot customers were not affected, and their own closing line on RovoBlast draws the arc: "Reprompt first showed this risk in consumer AI. RovoBlast shows how much higher the stakes are when the same patterns move into the enterprise."

That is the part that should worry you. Seven months, two vendors, and the same primitive walked from a consumer chatbot into a tool holding a company's Jira, Confluence, and Slack. It stops being a bug at that point and starts being a design default.

Here is the URL pattern Varonis published:

https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=<prompt>

The researchers also found that the organization ID segment of the path could be left empty and Atlassian would route the request into the user's own default organization. The attacker did not need to know where the victim worked. The victim's browser supplied that.

The assistant enumerated its own blast radius

Once they could run instructions as the user, the researchers asked the obvious question directly: what can you see?

Rovo answered. Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, relational databases, uploaded files, web pages, archived content. Atlassian's own connector catalog supports more than 50 platforms, so the real list depends on how enthusiastically a given company wired things up.

Read access alone is embarrassing, not catastrophic. Data has to get out. And the exit was already installed.

Rovo ships a built-in tool called ResearchAgent, which does deep multi-source open web research and multi-step browsing and navigation across arbitrary websites, autonomously. Read those two capabilities as a single sentence and you have fetch, transform, upload. Varonis demonstrated it three ways: Confluence pages, Jira tickets, and SharePoint content holding personal data, each pulled from inside and pushed to somewhere externally reachable, as SecurityWeek reported from the DEF CON session.

One click. No chained requests, no encoding tricks, no role-play framing. Varonis described Rovo's guardrails around untrusted prompts as "almost non-existent," and said a single seeded link was usually enough to get the assistant to retrieve and summarize sensitive material.

Chaining the steps inside one agent run bought the attacker something extra: fewer user-facing interruptions and an audit trail that reads like somebody doing research. Which is exactly what the logs would say, because that is what happened.

Enter, evade, escape

The most useful thing in the Varonis write-up is not the exploit. It is the table underneath it.

They line up eleven attacks against different AI products, including Reprompt, RovoBlast, SearchLeak, EchoLeak, ForcedLeak, GitLab Duo, ShadowLeak, AgentFlayer, and CometJacking, and sort each one into three columns: how the instruction got in, how it got past controls, how the data got out. Different vendors, different technologies, one shape.

Simon Willison's lethal trifecta covers most of this ground already: private data, untrusted content, and the ability to communicate externally. Varonis adds a correction worth keeping. Direct internet access is not required for the escape. In their SearchLeak research the assistant itself could not reach the internet, and the data still escaped, in their words, "through trusted services and browser behavior."

That is the operational lesson. Closing one exit does not close the category. Link previews, image fetches, webhooks, logs, third-party connectors, and every other agent action that touches a network are all candidate exits, and you will not enumerate them from a threat model diagram. You enumerate them by asking, tool by tool, what this thing can send and where.

My position: the taint label is the missing primitive. Every one of these attacks turns on content crossing a trust boundary and never being marked as having crossed it. We built a whole industry on the idea that a model's context is one undifferentiated stream of text, and then we started attaching enterprise credentials to it. Provenance inside the context window is the thing nobody ships, and until somebody does, "treat untrusted input carefully" is advice with no mechanism behind it.

Put this into practice

If you build an assistant surface, start here.

Grep your own query strings. Look for any parameter whose value ends up in a model's context: ?q=, ?prompt=, ?message=, ?query=, anything a marketing page or an integration uses to deep-link into a conversation. Every one of those is an instruction channel with no authentication on the instruction.

Pre-fill, do not auto-run. The distinction between text sitting in an input box and text already executing is the entire attack. Make externally seeded prompts require one deliberate human action, and render them visibly as external in the interface.

Split the read scope from the exit. RovoBlast needed both. If a session was seeded from a URL parameter, that session should not get the autonomous browsing tool. Capability, scoped by provenance, is a control you can build today without solving prompt injection.

If you buy and operate these tools rather than build them, your controls are blunter but still real.

Cut what the assistant can reach. Disconnect integrations nobody actively uses. Keep legal, HR, finance, and incident response content out of scope entirely, which is the recommendation Varonis leads with, and the one most likely to survive contact with your actual environment.

Turn off browsing agents and multi-step automation where teams are not relying on them. Then test it: send yourself a seeded link, run a benign version of the chain, and go read your own logs. If the run is indistinguishable from ordinary assistant activity, you have learned something more useful than any vendor assessment will tell you.

Ask one procurement question you probably have not asked: can this assistant be fully disabled? For Rovo the answer is no. Varonis flags that Rovo cannot be fully uninstalled from an Atlassian environment, which means the surface is not removable by policy. That belongs in a risk register, not a footnote.

Honest limitations

I did not reproduce any of this. The research is Varonis's, the reported path is patched on Atlassian's and Varonis's word, and I am reading a vendor write-up plus the trade coverage of a conference talk.

Varonis sells data security and AI security products that detect this class of behavior, and their recommendations map neatly onto what they sell. That does not make the findings wrong, and a public Bugcrowd disclosure record plus a DEF CON talk is stronger evidence than a blog post standing alone. Read the recommendations with the incentive in view anyway.

Atlassian's side of the story is not in the public record. SecurityWeek's coverage carries a footnote saying the company's statement was removed at Atlassian's request, so what you are getting is one party's account of the timeline.

The "cannot be fully uninstalled" claim traces to an Atlassian community article rather than a formal product statement, so check your own tenant's configuration options before treating it as absolute. Vendors change this kind of thing.

No CVE identifier surfaced for RovoBlast in the coverage I could reach, and nobody has reported exploitation in the wild. Treat this as a demonstrated capability, not an active incident.

And the fix I am arguing for is expensive. Provenance tracking through a context window is real engineering work that no major vendor has shipped, which is why my practical advice for operators is mostly scope reduction. Scope reduction is a weaker control than tainting, and I would rather say that than pretend otherwise.

What to do with this

Pick one assistant your company deployed in the last year. Find out whether it accepts a prompt through a URL. Find out what it can read. Find out what it can send, and to where.

Three questions, one afternoon. If the answers make you uncomfortable, that discomfort is the finding, and you got it without anyone crafting a link first.

Sources: Varonis Threat Labs on RovoBlast, Varonis on Reprompt, SecurityWeek, Infosecurity Magazine, Atlassian Rovo Connectors.