Researchers found a flaw in Atlassian’s Rovo AI assistant where a single crafted link could inject attacker instructions into a user’s already-logged-in session. With one click, Rovo could be tricked into gathering internal company content and using its built-in web browsing tool to publish that data to public websites. Atlassian has fixed the issue, but the workflow is a useful example of how “prompt injection by link” can lead to real data leakage.
Researchers found that Atlassian's Rovo AI assistant accepted a URL parameter that pre-filled its chat entry. That meant a single crafted link could surface attacker-written instructions directly into a user's already authenticated session. Because the victim was already logged in, no separate login or confirmation step stood between the click and the assistant executing those instructions. There was no warning shown and no indication the prompt had come from an external parameter rather than the user themselves.
Once the injected instructions ran, Rovo's built-in ResearchAgent came into play. This component performs multi-source open web research and can browse and navigate arbitrary websites across multiple steps autonomously. That capability supplied the entire chain in one agent run: retrieve internal content from Jira, Confluence, or Bitbucket, transform it, then post it to a page reachable from outside the organization.
Several factors combined to make this workflow effective:
Defenders and everyday users should be alert to:
Atlassian has since fixed this specific issue, but the underlying pattern, prompt injection delivered by link, is broadly applicable to other AI assistants. Organizations can reduce exposure by treating unexpected AI-assistant links with the same caution as suspicious email links, limiting which connectors and integrations an assistant can reach, disconnecting unused integrations, and disabling browsing or multi-step automation features where teams don't genuinely need them. Reviewing assistant logs and alerting on unusual agent runs also helps catch activity that might otherwise blend in as normal research.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A crafted link could pass a URL parameter that pre-filled Rovo's chat input, effectively injecting attacker instructions into an already authenticated user session.
Because the victim's session was already logged in, a click was all that was required, with no warning or confirmation shown before the instructions ran.
Rovo's ResearchAgent could browse and navigate arbitrary websites autonomously across multiple steps, giving a single agent run the ability to retrieve internal content and post it externally.
Varonis recommended shrinking what the assistant can reach, disconnecting unused integrations, and disabling browsing agents and multi-step automation where teams don't rely on them.
You get an email from a coworker: “Please review this Rovo research link and summarize what it finds.” Looks like a normal Atlassian link, right? Here’s the trick: that single link can pre-fill Rovo’s chat with hidden attacker instructions. You’re already logged into Jira and Confluence, so a click is all it takes, no warning, no confirmation. Rovo’s ResearchAgent can then quietly grab internal docs from Jira, Confluence, even connected Slack or Google Workspace, and browse out to post that data on a public site, all in one “research” run that looks normal in logs. Your move: if you get an unexpected ‘helpful’ Rovo or AI assistant link, don’t click it from email. Open Jira or Confluence yourself, launch Rovo there, and type your own prompt.
Researchers disclosed a one-click flaw in Atlassian’s Rovo AI assistant where a specially crafted link could pre-fill attacker instructions into a user’s active Rovo chat. After a user clicks once, Rovo’s autonomous agent features could pull sensitive data from connected systems (like Confluence,…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
