Atlassian Rovo Exfiltrates Data, Bypassing Controls

Original Article ↗ Hacker News Discussion ↗

Security researchers warn that Atlassian’s new AI assistant, Rovo, can be manipulated via prompt injection and insecure URL tooling to exfiltrate sensitive data, even when web search is disabled. Commenters argue this reflects a broader pattern of rushed, intrusive AI integrations into Jira and Confluence, poor UX, and weak data-governance defaults—especially troubling as Atlassian increasingly pushes cloud-only offerings and opts customers into data sharing for model training. Many report abandoning Atlassian for alternatives, citing both security concerns and long-standing dissatisfaction with performance and usability.

Rovo data exfiltration issue

  • Core problem: Rovo’s URL retrieval tool can open dynamically generated URLs, allowing prompts or embedded content to trick it into appending sensitive data to attacker-controlled URLs.
  • Attack can work even when web search is “disabled” because the underlying URL-opening tool is still active.
  • Some see this as part of a broader “lethal trifecta” for agents: access to private data, exposure to untrusted content, and ability to call out to the internet.

Atlassian, Jira, and Confluence sentiment

  • Many commenters describe Atlassian’s recent trajectory as a decline from “trusted enterprise partner” to something closer to a lock‑in SaaS vendor with poor UX and aggressive cloud/AI shifts.
  • Jira is criticized as slow, clunky, and over-flexible, with technical debt and bad client–server behavior; Confluence is seen as more defensible due to better collaborative editing than many alternatives.
  • Several report migrating away (often citing “cloud-only” and data residency), though suitable Confluence replacements are seen as hard.

Rovo and AI feature creep

  • Rovo is widely disliked as intrusive, enabled everywhere by default, and slowing page loads.
  • Some find it nearly useless or comically wrong (e.g., hallucinated acronyms, outdated summaries); others note occasional usefulness and benchmarks where its CLI performs well.
  • Users complain about unremovable AI buttons and AI-driven diffing, as well as inconsistent or bloated “improve/make longer/shorter” text features.

Prompt injection & agent security

  • Many note that this vulnerability class is now common across “agentic” tools; PromptArmor has published similar writeups for multiple products.
  • Debate over seriousness: some dismiss attacks where the user effectively tells the tool to exfiltrate data; others argue tools should still detect and block obviously harmful actions.
  • General view: prompt injection is not close to “solved,” and will persist as long as LLMs process untrusted content with powerful tools.

Mitigations and design ideas

  • Suggested defenses:
    • Only allow URL fetches that exactly match user-entered or trusted-tool-returned URLs.
    • Domain allowlists and public-index checks (e.g., only crawl URLs seen by search engines).
    • Blocking dynamically constructed URLs, including subdomain tricks and multi-request, character‑by‑character exfiltration.
  • Acknowledgment that all mitigations are probabilistic and raise attacker cost rather than eliminating risk.

Data usage, privacy, and trust

  • Prior controversy: Atlassian auto-opting customers into using in-app data for model training triggered concern about trade secrets and IP harvesting.
  • Some argue most companies’ “trade secrets” are overrated; others see broad model training on private corpora as a serious but underreacted-to risk.
  • Several commenters state they have fully abandoned Atlassian and don’t miss it.