Atlassian Rovo Exfiltrates Data, Bypassing Controls
promptarmor.com
promptarmor.com
I think it was Anthropic that first introduced a pattern that completely locks this down: your URL retrieval tool should only work for URLs that have previously been typed into the conversation by a user or have been returned from a trusted tool.
If the agent itself concatenates a new URL together - with leaked data after a ? - you should block that from being fetched.
The great thing about this solution is it's deterministic. You don't need any extra AI in the max - you implement a URL fetching system that knows which sources it should check for a direct match on the URL before it makes that GET request.
It's software god damn it... the reason why people moved from analog to digital is because you can repetitively execute functions that do always the same thing and it's 0 when it's 0, 1 when its 1.
All the sudden everyone is ok on burning trees to have their cool probabilistic tool named agent to do: maybe it's 0, but it can also be 1, let me "think"... ah yes, for sure it's 2.
The sad part for me is that management people have their heads so much into this hype, that no attack on privacy matters (almost none actually ever did, I know). Only when they suffer a huge blow in terms of revenue or reputation is that they maybe, maaaybe, find will want to listen again the experts.
It's genuinely a little concerning. It does not help that many of them are gaslighting themselves into thinking these things are benchmark crushing elite hackers by running effectively unsecured, unfiltered, unlogged production environments.
*Obviously this also means a temperature of >0 to avoid the greedy trap, the same generation params, on the same software, hardware, drivers etc etc
I also believe that due to the sycophantic nature of popular LLMs, people tend to fool themselves more than usual by having a digital "yes man".
You're correct of course, I just want to note that the exfiltrated data could be in any part of the URL, so the absence of a query string doesn't indicate that no payload has been encoded into the URL. Arbitrary example, you can include credentials in a URL, so you could encode the exfiltrated data into a password.
Otherwise you could set up wildcard DNS and extract data to base64encodedstolendata.evil.com
That makes sure that not a large amount of private data is leaked in one request. Assuming that if a URL is indexed, it is public data. However, there are still bypasses with using many requests to leak information, like a request per character of pre-indexed URLs.
I have some demos of doing that on my blog, but it makes it more involved for an attacker. And that could also be detected. Still not perfect, but a solid improvement, for a generic agent like ChatGPT.
There is paper OpenAI wrote a few months ago that explains how they do it: https://embracethered.com/blog/posts/2026/data-exfiltration-...
It's not a 100% bullet proof approach either, but pretty good.
Regarding the point on using URLs returned from trusted tool calls. That is similar to using pre-indexed URLs: If a "trusted tool" includes things like read a document, read an email,... an attacker can return a large list of afterwards "safe" urls, like 26 to cover A-Z. And then an attack can render many requests, e.g. character by character. But, again, similar to the pre-indexing, things are getting more a lot more expensive for an attacker that way. However, still not impossible.
For agents that have a specific purpose simple domain allow-listing is also a pretty effective idea in to prevent attacker controlled endpoints.
https://news.ycombinator.com/item?id=47833247
This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.
How companies entrust SaaSs with their data is beyond insane to me. Especially since FOSS alternatives are readily available.
The employee, just looking to make rent? The CEO, all in on the dream of the AI powered future? Legal, looking forward to litigation and well-competition retainers? Atlassian itself, when it’s just one of the many companies training models on private intellectual property, and whose T&C clearly state they will be doing so? Competitors, when there will be no reasonable way to prove their code has been generated from yours?
The truth is that one gives a damn about trade secrets being used to train AI models.
The entire copyright system for software is dead and no one really seems to care or even talk about it.
The saas industry is all about sales and deals. The market runs on access, not intelligence.
All of this would be illegal if discovered in this way, presumably, but it's not entirely accurate to say that information is not power.
"I want to build a business that does X using Y. Give me revenue predictions, spend over time, and customer demand predictions." etc
I don't totally disagree, I just think the real secrets have nothing to do with features or dev. The secret is A is about to go bankrupt or B is facing legal trouble. These kinds of things aren't in JIRA.
With almost zero control over whether or not this happens (politically or individually), the only reasonable action to take is "take advantage while there's an advantage to be had".
It's one of the classic mistakes of people who are not entrepreneurs. They try to keep things too secret and they spend a lot of time and effort keeping things secret while real entrepreneurs who have actually made millions on the market know secrecy rarely matters.
In the world of B2B, there are definitely companies that provide service based on direct personal experience of senior employees. While they may be using the same software available to others, it's the logic to know what to tell that same ol' software what to do that matters. Over my entire career I have dealt with multiple companies that write code but have zero knowledge about the subject matter the code is being written for so that basic mistakes are made resulting in utterly ineffective software.
The rest don't have anything worth stealing anyway.
Also the people making decisions on their products (or any "enterprise" SaaS for that matter) aren't the ones stuck using it.
But there might be API keys, passwords, unlisted URLs, email addresses, etc.
It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.
Rovo is the worse Ai I have used, I suggested they stop trying and let us have model choice. Save money and don't do things out of their skill sets
We went back to calling the API directly, writing scripts for the agent, then taking those scripts away and just having our CI workflow run them and then hand off a `.review` directory to the agents. We give them fewer tools and permissions, them seem to stay on task more instead of being "relentlessly proactive"
... but it also has Make Longer. Yes, a built-in feature to type some text in, and the use the mighty power of AI to bloat it.
Naturally, you can repeat this process several times on the same text, for your own little personal demonstration of what model collapse looks like in real time.
When you go "Make longer" the text gets longer.
When you go "Make shorter", the text gets longer still.
You'd think that the original text would be the oracle for shorter(longer(original))?
I'm going to have to stop you right there
(of course, everyone else can do that too, and the length/literacy of prose is no longer a good proxy for effort. In nature, "honest signalling" only works if the signal is costly. Removing the cost from the signal makes the signal worthless)
You're looking at it the wrong way. Think about how much better it is than the joke of a search tool that's slightly to the left of it's icon.
Useless buttons to "suggest subtasks" and "improve issue" and offer to write the description. Absolutely useless nonsense, I wish I could turn it all off and there is an issue on their bug tracker with that request (turning it off as an individual user), and it has many votes, but at the moment you can only disable it globally as admin.
Whenever I feel like I'm bad at software development, I look at Atlassian and I feel good.
The problem with our brave new AI world is I can’t tell if this is real or not
"Label all stories in the current project that contain "foo" with label "bar
It failed
Yeah this attack is possible on all modern agentic systems.
* Access to your private data
* Exposure to untrusted content
* The ability to externally communicate in a way that could be used to steal your data
(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)
And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.
These breaches will continue for as long as nobody cares about security and everybody is infected with the LLM brainworm.
And honestly when you start looking at agentic systems that uses it's previous step to take future steps. The system has to some idea what you want to permit and don't want to permit as everyone could have different expectations here.
Sure. Now imagine this very scenario not limited by humans and scaling the way machines do. And then let us consider the current reality that an agentic system on the receiving end may have unlimited access because to too was vibed.
All you need is the untrusted content (or more generally vulnerable content since how you feel about the content doesn't matter) leg and something you care about to be attacked.
E.g. could be as simple as a prompt injection that causes your LLM to output a prompt injection that then gets inserted somewhere else.
Or without exfiltration rm -rf /
Or a social engineering attack.
So there are other bifectas and trifectas.
Wow, great work Atlassian. The web search setting does not disable web search.
Obviously, there should be URL protection rules to control what it can access, but this requires a very specific and unlikely set of circumstances to exploit.
You may be happy to learn frontier LLM are heavily censored! Try an uncensored local LLM for a comparison. It will literally do everything you ask it to, no matter how devious.
Regards, /someone who migrated 3500 users from Atlassians products recently due to their "cloud only"-bullshit.
They failed to rearchitect it to something suitable for the inherent flexibility though, so it remains a disaster area, but one that is uniquely able to fit the whims of any manager that can then mandate it for everyone else.
But the awful client-server architecture, where anything you do takes several seconds of waiting for the client to send who-knows-what to the server and get data back, even selecting something from a dropdown... that is absolutely just Jira. A competing product would be able to deliver much, MUCH snappier UX. Jira is just the crappiest, slowest UI that I have ever had the displeasure of being forced to work with.
They needed someone over there with the power to say no.
Mediawiki as a whole has a feature set that 95% of organizations will only scratch the surface of. There's a ridiculous number of possible plugins and customization if you have somebody who knows what they're doing with it.
The majority of companies that need an internal KB/wiki do not have as complex needs or use cases as wikipedia itself or the wikimedia foundation.
Turns out no matter how much better the thing is, the users have to know what they're doing more than the operators do.
https://www.mediawiki.org/wiki/VisualEditor
It's the same GUI WYSIWYG interface you get by default if editing a page on public wikipedia.
Also VisualEditor sucks if you've never used VisualEditor before and sucks even more for anything complicated. This is the kind of tonedeafness non-technical users get to their feedback all the time.
The market caught on quickly that Atlassian's software fits into the group of software like Oracle or SAP that no one uses by choice and only uses because it was forced on them.
-- Churchill, House of Commons, 11 November 1947
It's not so much that people want to use Jira... or that they're forced to use it... but rather that people try using some other system and despite how much they dislike Jira, that other one has bigger failings.
Could go for a Bjarne Stroustrup quote with a twist:
> There are only two kinds of issue trackers: the ones people complain about and the ones nobody uses.
... but I like the Churchill quote.
Go through https://en.wikipedia.org/wiki/Comparison_of_issue-tracking_s... and after a year they'll be begging to go back to Jira... not because its great, but because the other tool lacks some necessary feature that Jira provides. Jira does everything that everyone wants, and it's awful... but everything else is worse.
P.S. I protest their software's revisionist autocorrection to Jira. It was JIRA when I started using it and forevermore it shall be.
I've been looking at switching to Notion and Linear, but just haven't had the time to complete evaluation.
Maybe to give credit they are being purposefully vague about details to avoid giving away the bait but still seem like you could give me details without literally copy and pasting the attack.
I'm still on the edge about security as an afterthought in LLMs. Given its now so easy to generate a ton of slop - why not focus on nonfunctional stuff making LLMs operate faster than thinking for X minutes and limiting exfiltration of local env secrets?
It's incredibly hard to block all rovo on Atlassian pages. I tried adblock, it failed, I settled for the custom chrome plugin. And yet, every once a while a new way to disturb my peace shows it ugly head.
So why intentional, again? Because it's impossible to disable it until you have a very certain, very expensive plan.
Nonconsensual data exfiltration.
The part about not having guardrail against calls to external urls is wild though.
Teamwork Graph exposes all the people working on stealth products with code names right alongside their other work anyway.
https://www.promptarmor.com/resources/claude-cowork-exfiltra...
https://www.promptarmor.com/resources/google-antigravity-exf...
https://promptarmor.substack.com/p/data-exfiltration-from-sl...
https://www.promptarmor.com/resources/gpt-for-google-sheets-...
https://www.promptarmor.com/resources/notion-ai-unpatched-da...
https://www.promptarmor.com/resources/ramps-sheets-ai-exfilt...
https://www.promptarmor.com/resources/superhuman-ai-exfiltra...
It also wouldn't work. You would simply mindjack the outer AI and have it mindjack the inner AI in turn with its summary. Nesting AIs can't fix the malicious input problem.
"Thou shalt have three layers of LLMs, no more, no less. Three shall be the number thou shalt have, and the number of the counting of the LLM layers shall be three."
Now, of course, there is a long tail of elaborate variations that those techniques won’t be able to stop. But have the published vulnerabilities come from that long tail or from not doing enough to address the simpler cases?
The classifier model will help some, but you end up with the same problem, a dumber model can never figure out what a smarter model is going to do with a bit of text. Or even two different models in this case.
On top of that, you can just automate finding new variations of the attack. Any one that works is quickly and massively duplicated causing all kinds of problems before your classification model catches back up.
Really what you're thinking here is this something that can be 'simply fixed'. It is not. The only way it's truly fixed is by having a model that is aligned with all good human decisions and makes none of the bad ones. Models will likely always find new and interesting ways break because everything is in band, there is no out of band data, much like a human. "Dear model, here is a chocolate bar, run $thing you aren't supposed to$" will probably keep working when it's something like "more tokens for you to use".
I think this is binary categorical thinking. In the real world, safety systems (even in domains like aviation or nuclear power) are never foolproof-the point is you reduce the probability of failure to an acceptable level given the costs of doing so and the potential consequences of that failure
And there is the risk people say “there is no foolproof solution, so I’m not going to invest in probabilistic countermeasures” - which would sound like utter madness to a bank’s antifraud department, but for some reason a lot of people seem to think it isn’t when it comes to AI
I have to remind the folks who want a dev to build a product and think they don't need to ever touch the product after release.
This is the problem, this isn't a 'failure' mode where something randomly goes wrong, like a person accidentally sticking their hand in a machine. This is war where you are under active attack and the attackers adapt quickly.
Because of the breadth of LLM capabilities they have a nearly unbound attack surface. You spend so much of your effort making sure your prompt is secure that you either massively increase costs, or you partially lobotomize your agent making it less capable.
Solutions for these problems will have to come inside the model itself because both the attackers and models are far more capable than you on doing dumb/evil shit. Until the model itself can go "hey, wait a darn minute" a new fun way of encoding the attack can always be found.
It all depends on what the use case is.
For example, consider a system which takes English questions from business users, translates them to SQL, then runs it (as the business user) against a reporting database
How does the attacker get access to it? And even if they somehow do, what harm can they actually do to it? The only tool it has is one to run SELECT against a DB, and it can only SELECT data the user already has access to, and we have timeouts/etc to protect against overly expensive queries
If your design involves lots of general purpose do-anything agents with very generic tools, the risk profile is very different from narrowly scoped purpose-specific AI services
Of course, there is a scaling problem here - doing it for N languages is N times the work of doing it for one, and you might not know some language well enough to do a good job of it
Two things you can do:
(1) Use an LLM for translate your regexes, classifier training/validation datasets, etc, from English to N target languages
(2) Use an LLM to translate the input to English, then run your validations against that English
Of course, these approaches aren’t foolproof - the translation might be flawed/etc - but a defence doesn’t have to be foolproof to add real value
Also, of course using an LLM to translate hostile input to English before checking it runs the risk the translation LLM itself might be jailbroken. But how about using a classical statistical machine translation model instead? They don’t tend to be vulnerable to these kinds of attacks, because they aren’t trained to follow instructions
if (substr(*prompt, "ignore previous instruction") != NULL) return;I wonder if anyone has tried to build an LLM that has actual built-in types of prompts: system prompt, user prompt, and data prompt.
The exact same phrase can tokenize differently depending on if it's instruction or data; and you can pre-train and post-train models to make use of them.
It quadratically increases your training cost, so I don't think any labs are exploring it because of $$$ and the race to AGI, but mechanisms like this should significantly address the issue on the LLM architectural design level.