decrypted · 8 august 2026 · ransomware and cybercrime · supply chain · ai and llm security

Atlassian's Rovo assistant, and the data leak it hasn't fully fixed

Atlassian's Rovo, the AI assistant now built into Jira and Confluence and switched on by default for most customers, failed two independent break-in attempts this week. Both attackers were security researchers, both attacks worked, and one of them still isn't fixed. Varonis and PromptArmor each found a way to get Rovo to read a tenant's own tickets and documents, then quietly post the contents to an address of the attacker's choosing. No stolen password, no malware, just a document or a link with an instruction hidden inside it. Atlassian is used right across UK organisations, from universities to NHS trusts to central government, which makes this worth understanding rather than skimming past.

Two ways in, one still open

Varonis's version, which they call RovoBlast, used a crafted link. Rovo's chat interface accepts a URL parameter that pre-loads a prompt into a session, and it does so without asking the user to confirm anything. One click, and Rovo's autonomous research agent starts pulling Confluence pages, Jira tickets and connected SharePoint content, then pushes it out through an ordinary image request to an external server. Atlassian fixed this server-side in July after Varonis reported it through Bugcrowd, and the pair presented the research at DEF CON 34.

PromptArmor's version doesn't need a link at all. Hide an instruction inside a document that Rovo will legitimately be asked to read, and the assistant builds a URL with the sensitive data appended, then fetches that URL itself to check it, exfiltrating the payload in the act of retrieval. It works even when an administrator has switched off Rovo's web search, because the underlying fetch capability is separate from search. PromptArmor reported this to Atlassian on 23 May. After an initial acknowledgement, Atlassian went quiet, and as of PromptArmor's public disclosure on 5 August, the flaw was still live.

The design fault sits underneath both

Both attacks work for the same reason: Rovo has no boundary between content it reads and actions it takes. An instruction buried in a Confluence page or a URL parameter is treated with the same trust as a request typed by the logged-in user, and nothing checks whether a web address the agent constructed itself is a safe place to send data before it goes there. This is the AI-era version of an old lesson: never let data control the structure of what a system does next. SQL injection taught the industry to stop trusting user input to build queries. The same discipline now has to apply to anything an AI agent reads before it acts on it.

For UK organisations the practical question is not "do we use Rovo's chat", it's "what have we already switched on". Enterprise AI assistants increasingly ship enabled by default across a SaaS estate, with connectors to Jira, Confluence, SharePoint and Outlook granted the moment a licence is turned on. Worth doing this week: check whether Rovo, Copilot, or an equivalent is live in your tenant, confirm what it's allowed to read, and ask your vendor whether outbound requests the agent makes on its own are restricted to an allowlist rather than left open to anywhere on the internet.

Also this week

A load balancer flaw attackers have been probing for weeks. CISA has added CVE-2026-8037, a critical (CVSS 9.6) command injection flaw in Progress Kemp LoadMaster, to its known exploited vulnerabilities catalogue. The bug sits in the appliance's escape_quotes() function and lets an unauthenticated attacker run arbitrary commands. eSentire logged 792 exploitation attempts from 65 IP addresses across 18 countries over 41 days, though none succeeded. Any UK organisation running LoadMaster at the network edge should patch now rather than wait to become the attempt that does succeed.

Nearly 850 npm packages built to look disposable. Sonatype is tracking a campaign it calls Flooding Dropper: 846 packages, published from many small throwaway accounts rather than one, each acting as a first-stage loader that fetches a platform-specific payload for Windows, Linux or macOS over HTTPS, with DNS as a fallback channel if the main route is blocked. There's no single publisher to ban and no install-time script to flag, which is what makes it awkward to catch with the usual dependency review.

A ransomware group has named a UK defence and space supplier, unconfirmed. The Qilin ransomware group listed Filtronic, the Sedgefield-based RF electronics maker that supplies SpaceX's Starlink ground stations and UK defence primes including BAE Systems and QinetiQ, on its leak site on 7 August. The listing gives no detail on what, if anything, was taken, and Filtronic has made no public statement. That makes this a claim, not a confirmed breach, but a leak-site posting naming a company sitting in both the defence and commercial space supply chain is worth watching for what comes next.

Sources

If you want a second opinion on your own AI-assistant exposure, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.