Loading story…
Varonis Threat Labs disclosed RovoBlast, a prompt-injection vulnerability in Atlassian’s Rovo AI assistant that could let an attacker use a crafted link to inject instructions into a user’s trusted AI session. According to the report, the issue abused the rovoChatPrompt parameter so that a single click could cause Rovo to retrieve and summarize sensitive organizational information from Atlassian products and connected SaaS services available through its connector ecosystem.
The researchers said Rovo’s autonomous capabilities, including ResearchAgent, could enable multi-step data collection and exfiltration with little or no further user interaction, amplifying the impact of the flaw. Atlassian fixed the issue after responsible disclosure, but the findings highlight broader enterprise AI risks created when untrusted inputs are combined with broad data access and autonomous actions, especially in environments where Rovo cannot be fully uninstalled and retains a wide practical attack surface.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Varonis published its public analysis of the RovoBlast vulnerability after presenting the research at DEF CON 34. The report detailed the Parameter-to-Prompt attack path in Atlassian Rovo and how a crafted link could trigger data exfiltration through Rovo's browsing capabilities.
Bugcrowd records show Atlassian deployed a server-side fix for the RovoBlast vulnerability on July 8, 2026. The remediation was validated by the researcher and the Bugcrowd report was marked resolved.
PromptArmor reported a separate indirect prompt-injection path in Atlassian Rovo where attacker-controlled instructions hidden in uploaded content could cause Rovo to gather data the signed-in user could access and send it to an external server. PromptArmor disclosed the issue to Atlassian on May 23, 2026, and later said the attack chain remained unresolved when it published its findings.
Varonis reported that its RovoBlast research was presented at DEF CON 34. The presentation framed the issue as a Parameter-to-Prompt attack path and highlighted the risks of broad-access enterprise AI assistants.
According to Varonis, Atlassian fixed the RovoBlast vulnerability following responsible disclosure. The article says the fix was published through Crowd Source in Bug Crowd.
Varonis stated that it responsibly disclosed the RovoBlast issue to Atlassian after identifying the flaw. The disclosure led Atlassian to address the vulnerability.
Varonis Threat Labs uncovered a vulnerability it named RovoBlast in Atlassian Rovo, where attacker-controlled instructions could be injected into a trusted Rovo session through the rovoChatPrompt URL parameter. The research found a single click on a crafted link could cause Rovo to retrieve and summarize sensitive organizational data across connected systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcecysecurity.news
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcereddit.com
Open sourcevaronis.com
Open sourcebugcrowd.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers warned that **AI agents and retrieval-augmented generation (RAG) systems** can be turned into data-exfiltration channels when attackers poison inputs or embed malicious instructions in content the model is expected to process. One report described a **0-click indirect prompt injection** against *OpenClaw* agents in which hidden instructions cause the agent to generate an attacker-controlled URL containing sensitive data such as API keys or private conversations in query parameters; messaging platforms like *Telegram* or *Discord* can then automatically request that URL for link previews, silently delivering the data to the attacker. The same reporting noted concerns about insecure defaults that allow agents to browse, execute tasks, and access local files, expanding the blast radius of prompt-injection abuse. Related analysis highlighted that the same core weakness extends beyond standalone agents to **enterprise RAG deployments**, where the integrity of the knowledge base becomes part of the security boundary. If attackers can poison indexed documents in systems such as SharePoint or Confluence, they can manipulate retrieval results and influence model outputs, including security workflows and analyst guidance. Broader commentary on **agentic AI threat convergence** reinforced that prompt engineering is no longer just a productivity technique but an emerging exploit class, with adversaries using prompt injection and context manipulation against AI-enabled security operations. Together, the reporting shows that enterprise AI risk increasingly depends on controlling untrusted content, hardening agent permissions, and treating prompts, retrieved documents, and downstream integrations as attack surfaces.
Aug 11, 2026
Security researchers reported multiple **prompt-injection-driven attack paths** that exploit how AI assistants and agentic systems process untrusted content. Microsoft researchers described **AI recommendation/memory poisoning** (mapped in MITRE ATLAS as **`AML.T0080: Memory Poisoning`**) in which attackers insert instructions that cause an assistant to persistently “remember” certain companies, sites, or services as trusted or preferred, shaping future recommendations in later, unrelated conversations. Observed activity over a 60-day period included **50 distinct prompt samples** tied to **31 organizations across 14 industries**, with potential downstream impact in high-stakes domains like health, finance, and security where manipulated recommendations can mislead users without obvious signs of tampering. A separate finding highlighted how **AI agents embedded in messaging apps** can be coerced into leaking secrets via **malicious link previews**. PromptArmor demonstrated that an attacker can use chat-based prompt injection to trick an AI agent into generating an attacker-controlled URL that includes sensitive data (e.g., API keys) as parameters; when messaging platforms (e.g., Slack/Telegram) automatically fetch **link preview** metadata, the preview request can become a **zero-click exfiltration channel**—no user needs to click the link for the data-bearing request to be sent. Together, the reports underscore that agent features intended to improve usability—*persistent memory*, URL-based prompt prepopulation (e.g., “Summarize with AI” buttons), and automatic preview fetching—can be repurposed into scalable manipulation and data-loss mechanisms when untrusted prompts are processed implicitly.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026