Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action — Atlassian Rovo Had Two Independent Prompt-to-Exfiltration Paths
- Primary source — RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data (Varonis Threat Labs, 2026-08-07)
- AIDEFEND SecureFlow — Atlassian Rovo Document Prompt Injection and URL Exfiltration
- AIDEFEND SecureFlow — RovoBlast: rovoChatPrompt One-Click Data Exfiltration
Two disclosures reached the same lesson through different Rovo entry points. In RovoBlast, an authenticated user opened an Atlassian URL containing an attacker-controlled rovoChatPrompt value; Rovo treated the parameter as prompt input and started the task without a separate warning or confirmation. The URL prompt then expanded into connected-data access: the ResearchAgent could search sources available through the victim's session and permissions, and the injected instructions selected content, encoded it into an attacker-controlled URL or image request, and caused Rovo to fetch that destination.
Atlassian completed a server-side remediation of that parameter route on 2026-07-08 through coordinated Bugcrowd disclosure. Separately, PromptArmor used hidden instructions in an uploaded document to make Rovo search Jira and Confluence, append results to an attacker URL, and open it — while the user had asked only to organise tickets. Disabling web search did not remove that sink: Rovo's URL-opening capability still fetched the model-constructed destination, so the vulnerable control plane was broader than the web-search setting. The brief keeps the paths separate: they are alternative entry and execution routes that converge only on the defensive lesson.
ASSESSED SYSTEM
Atlassian Rovo as configured before its July 2026 fixes: an authenticated user's Rovo session in which (a) an externally supplied rovoChatPrompt URL parameter was treated as prompt input and started a task without a separate warning or confirmation, and (b) hidden instructions in an uploaded document could drive the ResearchAgent to search Jira and Confluence within the user's permissions and send results through Rovo's URL-opening capability, which remained available with web search disabled. Both branches are entry points into one assessed product surface: untrusted content inheriting the session's connected-data and outbound-network authority.
OUT OF SCOPE
The two disclosures are kept as separate branches and are explicitly not treated as one attack chain — neither source states that an attacker must use rovoChatPrompt before uploading the malicious document. Jira and Confluence as products are connected data sources, not the assessed system. Atlassian's server-side remediation of the rovoChatPrompt route, completed 2026-07-08, closes branch one only; the uploaded-document branch is assessed in its reported state and its remediation status is tracked separately. No in-the-wild exploitation is reported, so no victim or campaign outcome is scored.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: Rovo's ResearchAgent is a single agent over connected sources; no peer-agent delegation is described. Q2 = YES: the ResearchAgent autonomously executes a multi-step research workflow — selecting sources, searching Jira and Confluence under the user's permissions, transforming results, and invoking a URL-opening capability — with no approval for any individual step. Evidence in the brief: the injected instructions selected useful content, encoded it into an attacker-controlled URL or image request, and caused Rovo to fetch that destination. Tier 2: Tier 2 (Consumer): Rovo is a broadly deployed assistant embedded in a widely used SaaS suite, operating inside each user's own permission scope, and the demonstrated harm — organisational content from Jira and Confluence sent to an attacker-chosen destination — lands on that user population and their organisations. The insider-permission framing of one branch does not lower the tier; it is reflected in the Attack Surface score.
Documented attack or failure path
- Branch one (RovoBlast): an authenticated user opens an Atlassian URL containing an attacker-controlled rovoChatPrompt value; Rovo treats the parameter as prompt input and starts the task without a separate warning or confirmation.
- Branch two (uploaded document): the user asks Rovo to organise tickets and supplies a document containing hidden instructions telling Rovo to search Jira and Confluence, append the results to an attacker URL, and open it.
- In either branch the ResearchAgent searches sources available through the victim's session and permissions, selecting content the user never asked to export.
- The injected instructions encode the retrieved content into an attacker-controlled URL or image request, and Rovo's own fetch or URL-opening capability contacts that destination. PromptArmor reports the URL-opening sink still fetched the model-constructed destination with web search disabled.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Retrieval remained inside the victim's own permission scope: the ResearchAgent searched only sources available through the victim's session and permissions, so no cross-tenant or privilege-boundary violation is reported and the underlying access-control layer is not scored as a failure.
- A web-search control existed and was exercised in the PromptArmor test — the user had it disabled. The brief's finding is that a second, independent outbound capability remained, not that the setting failed to apply to web search.
- Atlassian completed a server-side remediation of the rovoChatPrompt route on 2026-07-08 through coordinated disclosure, closing branch one at the product level.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–0.65 (midpoint 0.33), Tier 2 MVT 0.55 indeterminate | |||
| Pr-3Data Minimization Compliance | 0.00w 0.35 | 0.00 anchor: no minimisation exists between the declared task and the data the agent may reach — the session's full connected-source scope was available to content the user never authorised. The 0.25 anchor requires some minimisation to be present, and the brief describes none on this path. | A ticket-organising request obtained access to every connected source the user could reach. AID-H-018.004 states the missing requirement: derive a short-lived set of data sources and tools from the user's visible task, so that a request to organise tickets can access selected ticket fields but URL or document text cannot expand the scope to every connected Jira, Confluence, Slack, or Microsoft 365 source.source: brief |
| Containment (Cn) — scenario interval 0.00–0.56 (midpoint 0.28), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.00w 0.09 | 0.00 anchor: no effective scope boundary existed between the user's stated task and the agent's reachable source and destination set. The 0.25 anchor requires boundaries that exist but are inconsistently enforced; disabling web search left an independent generic URL-retrieval path unrestricted, which is an inventory gap rather than an enforced-but-leaky boundary. | Untrusted content inherited the session's connected-data and outbound-network authority in both branches. No task-scoped capability envelope constrained which sources the ResearchAgent could search or which destinations it could contact, and the brief notes the outbound-capable tool inventory was broader than the web-search switch suggested.source: brief |
| Cn-3Output Filtering Robustness | 0.00w 0.13 | 0.00 anchor: no output or egress filtering is evidenced on the sink — retrieved organisational content was transmitted directly to an attacker-chosen destination, which is the literal 0.00 criterion. | Sensitive values retrieved from Jira and Confluence were encoded into an attacker-selected URL or image request and left the boundary with no release check. AID-H-018.005 is the Very High recommendation precisely because connected-source values are not marked sensitive, that label is not preserved through model transformations, and nothing blocks them from attacker-selected URLs, images, or fetch requests.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.08 | 0.00 anchor: no reversibility classification is performed before execution and actions execute ungated (ARCR = 0). The chain rule is also absent — the visible hop was opening a link or uploading a file, and the highest-impact hop, external disclosure, did not govern the chain. | Contacting an attacker-controlled external destination with organisational content is a delegated-irreversible action — disclosure cannot be undone — and it executed with no pre-execution classification and no approval. AID-H-018.003 states the requirement: opening a link cannot authorize autonomous multi-source research, and a fresh decision bound to the exact prompt, data sources, destination, and intended output is needed before contacting an external destination.source: researcher |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: no origin labelling on either channel — content from outside the trust boundary (a URL parameter and an uploaded document) was admitted to active context as trusted instruction by design and acquired search and outbound-fetch authority end to end. The 0.25 anchor requires origin labels on at least some channels or instruction authority denied by prompt wording; the workpaper evidences neither. Moved from Ro-1 under the 26-sub-metric basis: the evidence describes only the admission of untrusted content as instruction (a boundary failure) and nothing about the model's resistance under adversarial testing, so Ro-1 is UNKNOWN. | Both branches admit untrusted content as authoritative instruction: an attacker-controlled rovoChatPrompt URL parameter was executed as a prompt with no warning or confirmation, and hidden text in an uploaded document drove multi-source search and an outbound fetch. Neither ingress placed the content in an untrusted namespace or neutralised it at the request boundary — AID-H-016.001 (uploaded-document text in an explicitly untrusted namespace that cannot supply tool or search instructions) and AID-H-002.002 (rejecting or neutralising an externally supplied prompt-execution parameter) are both recommended as controls the assessed configuration lacked.source: brief |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 1.00w 0.25 | The 1.00 anchor is met: the ResearchAgent independently selected sources, searched them, transformed the results, and invoked an outbound fetch, with no approval for any step. The user's action in both branches was a single click or upload. elevated |
| AsAttack Surface Exposure | 1.00w 0.35 | The 1.00 anchor is met: fully attacker-controlled content reaches the agent's instruction path directly through two independent ingresses — a URL parameter that starts a task and an uploaded document whose hidden text drives tool use. Neither requires the attacker to hold any Atlassian permission. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in an external, irreversible node — organisational content from Jira and Confluence delivered to an attacker-controlled destination — and the reachable set is every connected source the victim's session can address, not only the one the user was working in.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | Scored above the deployment-infrastructure anchor because the two branches have separate remediation states and separate closure evidence. Atlassian's 2026-07-08 server-side fix closes the rovoChatPrompt route, but the brief is explicit that closing one branch is not evidence that the other is remediated, and the uploaded-document path needs instruction/data separation, intent-derived scoping, and value-level sink enforcement — three distinct application-layer controls. No retraining is required, which keeps it below the higher anchors. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | At the 0.25 anchor. The brief identifies the product surface, both ingress mechanisms, the parameter name, the agent component, the outbound sink, the fix date for one branch, and the fact that a capability survived the web-search setting. It identifies no tenant, connector inventory, tool manifest, identity policy, or evaluation artefact for a specific deployment, and no AIBOM or equivalent record exists. |
| Ec — Public evaluation coverage | 0.18 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.95. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.19 | Evidence dated 2026-08-07; age 72 days on the workpaper reference date. Components: T_behavior 0.19 · T_containment 0.33 · C_event 0.35 · C_behavior 0.40 · T_calendar 0.57 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. BAW applies: Rovo maintains conversational and task state across a session, and both branches depend on injected content persisting into subsequent tool selection within that state. C_monitor 0.65 — no detection of either path is evidenced; the brief has to ask defenders to start applying value-aware sink tests to encoded, chunked, transformed, and redirected sensitive values. C_event 0.35 — the major row applies: a confirmed critical-invariant violation, namely organisational content sent to an attacker-controlled destination without user authorisation. C_behavior Band 0 (0.40) — no canary set, no registered invariants, and no maintained drift baseline are evidenced, the specification's worst-case default band. C_evidence 0.85 — the finding is only partly resolved: one branch has a dated server-side fix and the other has no published closure, and the brief insists the two carry separate remediation evidence and separate closure decisions. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.21 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
7.6 midpoint, interval 3.0–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementAIDEFEND dataVersion 2026.10.15. Marking Jira, Confluence, and other connected-source values sensitive, preserving that label through model transformations, and blocking them from attacker-selected URLs, images, or fetch requests is the shared Cn-3 control that breaks exfiltration in both branches even when retrieval is allowed. | Very High | Cn-1 Cn-6 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingAIDEFEND dataVersion 2026.10.15. Deriving a short-lived set of data sources and tools from the user's visible task is the Pr-3 and Cn-1 control whose absence lets a ticket-organising request reach every connected source. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationAIDEFEND dataVersion 2026.10.15. Rejecting an externally supplied prompt-execution parameter at the request boundary, or making it inert display text, is the Cn-8 control for the rovoChatPrompt route; the brief notes uploaded documents need separate instruction/data and tool-policy controls. | High | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationAIDEFEND dataVersion 2026.10.15. Placing uploaded-document text in an explicitly untrusted namespace that cannot supply tool or search instructions is the Cn-8 control for the second branch. | High | Ro-1 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateAIDEFEND dataVersion 2026.10.15. A fresh decision bound to the exact prompt, data sources, destination, and intended output before contacting an external destination is the Cn-6 gate whose absence makes ARCR = 0 for the disclosure. | High | Cn-1 Cn-6 Cn-7 |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleAIDEFEND dataVersion 2026.10.15. Verifying Atlassian's 2026-07-08 server-side fix against the exact rovoChatPrompt auto-execution route, and tracking the uploaded-document disclosure as a separate finding with its own closure evidence, is the Rf remediation route. | High | Ro-4 Ro-5 Tr-4 |
WHAT THIS CASE TEACHES
Disabling web search did not remove the sink, and that is the scoring lesson: Cn-1 is not measured by which features are switched off but by the complete inventory of outbound-capable tools an untrusted instruction can reach. A control that governs one named capability while a generic URL-retrieval path remains unrestricted is an inventory gap, which is why this scores 0.00 rather than the 0.25 that an enforced-but-leaky boundary would earn.
Sources: AIDEFEND in Action — Atlassian Rovo Had Two Independent Prompt-to-Exfiltration Paths · Primary source — RovoBlast: How One Click Triggered Atlassian's AI Assistant to Leak Data (Varonis Threat Labs, 2026-08-07) · AIDEFEND SecureFlow — Atlassian Rovo Document Prompt Injection and URL Exfiltration · AIDEFEND SecureFlow — RovoBlast: rovoChatPrompt One-Click Data Exfiltration
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- RovoBlast: rovoChatPrompt One-Click Data Exfiltration (component path · AIDEFEND curated research flow)ATLAS techniques: AML.T0051.000, AML.T0053, AML.T0025
- Atlassian Rovo Document Prompt Injection and URL Exfiltration (component path · AIDEFEND curated research flow)ATLAS techniques: AML.T0051.001, AML.T0053, AML.T0077, AML.T0025