Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-09 · source-backed
Varonis Threat Labs disclosed at DEF CON 34 that Rovo's rovoChatPrompt URL parameter pre-fills content straight into a victim's live AI session, and leaving the organization ID blank silently routes into the victim's default org with no warning (SecurityWeek). Rovo's built-in ResearchAgent, which can autonomously browse and navigate arbitrary sites, then pulls internal Jira, Confluence, and SharePoint content and pushes it to the open web in one automated chain. Varonis calls the class parameter-to-prompt injection, the same pattern they reported in Microsoft Copilot as Reprompt in January. Atlassian fixed it before publication. If your agent product accepts prompt content via URL parameter, you have this bug.
Each link below shares sources, entities, or timing with this story.
Atlassian released Rovo / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian, Atlassian Rovo, Confluence, Jira; overlapping topics (agent, atlassian, rovo).
Atlassian released Rovo / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian, Confluence, Jira; overlapping topics (agent, arbitrary, atlassian, attacker).
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian, Confluence, Jira; overlapping topics (agent, atlassian, autonomously).
Atlassian released Rovo / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian, Rovo; overlapping topics (atlassian, rovo).
GitHub Copilot partners with Jira / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (GitHub Copilot partners with Jira); both cover Atlassian, Jira; overlapping topics (agent, atlassian).
Atlassian released Rovo / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian, Rovo; overlapping topics (agent, atlassian).
Linked by a graph relationship (Atlassian released Rovo); both cover Jira, Rovo; overlapping topics (agent, atlassian).
Atlassian released Rovo / Shared entity: Atlassian / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Atlassian released Rovo); both cover Atlassian; overlapping topics (agent, atlassian).