Loading story…
Varonis Threat Labs disclosed RovoBlast, a prompt-injection vulnerability in Atlassian’s Rovo AI assistant that could let an attacker use a crafted link to inject instructions into a user’s trusted AI session. According to the report, the issue abused the rovoChatPrompt parameter so that a single click could cause Rovo to retrieve and summarize sensitive organizational information from Atlassian products and connected SaaS services available through its connector ecosystem.
The researchers said Rovo’s autonomous capabilities, including ResearchAgent, could enable multi-step data collection and exfiltration with little or no further user interaction, amplifying the impact of the flaw. Atlassian fixed the issue after responsible disclosure, but the findings highlight broader enterprise AI risks created when untrusted inputs are combined with broad data access and autonomous actions, especially in environments where Rovo cannot be fully uninstalled and retains a wide practical attack surface.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Bugcrowd records show Atlassian deployed a server-side fix for the RovoBlast vulnerability on July 8, 2026. The remediation was validated by the researcher and the Bugcrowd report was marked resolved.
PromptArmor reported a separate indirect prompt-injection path in Atlassian Rovo where attacker-controlled instructions hidden in uploaded content could cause Rovo to gather data the signed-in user could access and send it to an external server. PromptArmor disclosed the issue to Atlassian on May 23, 2026, and later said the attack chain remained unresolved when it published its findings.
Varonis reported that its RovoBlast research was presented at DEF CON 34. The presentation framed the issue as a Parameter-to-Prompt attack path and highlighted the risks of broad-access enterprise AI assistants.
According to Varonis, Atlassian fixed the RovoBlast vulnerability following responsible disclosure. The article says the fix was published through Crowd Source in Bug Crowd.
Varonis stated that it responsibly disclosed the RovoBlast issue to Atlassian after identifying the flaw. The disclosure led Atlassian to address the vulnerability.
Varonis Threat Labs uncovered a vulnerability it named RovoBlast in Atlassian Rovo, where attacker-controlled instructions could be injected into a trusted Rovo session through the rovoChatPrompt URL parameter. The research found a single click on a crafted link could cause Rovo to retrieve and summarize sensitive organizational data across connected systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityweek.com
Open sourcethehackernews.com
Open sourcereddit.com
Open sourcevaronis.com
Open sourcebugcrowd.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers warned that **AI agents and retrieval-augmented generation (RAG) systems** can be turned into data-exfiltration channels when attackers poison inputs or embed malicious instructions in content the model is expected to process. One report described a **0-click indirect prompt injection** against *OpenClaw* agents in which hidden instructions cause the agent to generate an attacker-controlled URL containing sensitive data such as API keys or private conversations in query parameters; messaging platforms like *Telegram* or *Discord* can then automatically request that URL for link previews, silently delivering the data to the attacker. The same reporting noted concerns about insecure defaults that allow agents to browse, execute tasks, and access local files, expanding the blast radius of prompt-injection abuse. Related analysis highlighted that the same core weakness extends beyond standalone agents to **enterprise RAG deployments**, where the integrity of the knowledge base becomes part of the security boundary. If attackers can poison indexed documents in systems such as SharePoint or Confluence, they can manipulate retrieval results and influence model outputs, including security workflows and analyst guidance. Broader commentary on **agentic AI threat convergence** reinforced that prompt engineering is no longer just a productivity technique but an emerging exploit class, with adversaries using prompt injection and context manipulation against AI-enabled security operations. Together, the reporting shows that enterprise AI risk increasingly depends on controlling untrusted content, hardening agent permissions, and treating prompts, retrieved documents, and downstream integrations as attack surfaces.
Jul 3, 2026
Security researchers reported multiple **prompt-injection-driven attack paths** that exploit how AI assistants and agentic systems process untrusted content. Microsoft researchers described **AI recommendation/memory poisoning** (mapped in MITRE ATLAS as **`AML.T0080: Memory Poisoning`**) in which attackers insert instructions that cause an assistant to persistently “remember” certain companies, sites, or services as trusted or preferred, shaping future recommendations in later, unrelated conversations. Observed activity over a 60-day period included **50 distinct prompt samples** tied to **31 organizations across 14 industries**, with potential downstream impact in high-stakes domains like health, finance, and security where manipulated recommendations can mislead users without obvious signs of tampering. A separate finding highlighted how **AI agents embedded in messaging apps** can be coerced into leaking secrets via **malicious link previews**. PromptArmor demonstrated that an attacker can use chat-based prompt injection to trick an AI agent into generating an attacker-controlled URL that includes sensitive data (e.g., API keys) as parameters; when messaging platforms (e.g., Slack/Telegram) automatically fetch **link preview** metadata, the preview request can become a **zero-click exfiltration channel**—no user needs to click the link for the data-bearing request to be sent. Together, the reports underscore that agent features intended to improve usability—*persistent memory*, URL-based prompt prepopulation (e.g., “Summarize with AI” buttons), and automatic preview fetching—can be repurposed into scalable manipulation and data-loss mechanisms when untrusted prompts are processed implicitly.
Jun 29, 2026
Researchers and security outlets reported multiple indirect prompt injection weaknesses affecting AI-driven browsing and assistant features, showing how hidden instructions embedded in untrusted web content can manipulate model behavior and steer users into credential theft or data exposure. Cato Networks disclosed **WebPromptTrap** in BrowserOS, where malicious webpage content abused Agent Chat Mode summarization to insert a convincing call to action and attacker-selected link; in the proof of concept, victims could be pushed into a GitHub authorization flow that exposed access tokens and repository access. Cato said the issue affected BrowserOS `0.30.0` and earlier, was identified in `0.29.0`, and was fixed in `0.32.0` after responsible disclosure. Separate reporting described similar risks in OpenAI's **ChatGPT Atlas** browser and in Microsoft **Copilot**, underscoring that the problem extends beyond a single product. LayerX said Atlas could be fed malicious instructions through web content in a "tainted memories" attack, while Axios, TechSpot, and commentary from OpenAI CISO Dane Stuckey highlighted broader security and privacy concerns around prompt injection in AI browsers. Varonis also detailed **Reprompt**, a single-click Copilot attack that could silently exfiltrate personal data. Together, the disclosures show that AI systems that summarize pages, retain context, or act on behalf of users can be turned into phishing and data-theft intermediaries unless untrusted content is strictly isolated from model instructions.
Jun 29, 2026