Atlassian Rovo Exfiltrates Data, Bypassing Controls

Posted by hackerBanana 3 hours ago

Atlassian Rovo Exfiltrates Data, Bypassing Controls(www.promptarmor.com)

89 points | 28 comments

htrp 1 hour ago|

I feel like prompt armor writes the exact same blog post for every agentic tool because they all suffer from the ignore previous instructions prompt injections.

https://www.promptarmor.com/resources/claude-cowork-exfiltra...

https://www.promptarmor.com/resources/google-antigravity-exf...

https://promptarmor.substack.com/p/data-exfiltration-from-sl...

https://www.promptarmor.com/resources/gpt-for-google-sheets-...

https://www.promptarmor.com/resources/notion-ai-unpatched-da...

https://www.promptarmor.com/resources/ramps-sheets-ai-exfilt...

https://www.promptarmor.com/resources/superhuman-ai-exfiltra...

nemomarx 54 minutes ago|

How could they not? If some lab had a method to make really secure guard rails or avoid prompt injection thoroughly I think they would be trumpeting it. But the basic mechanics of language models are vulnerable to this unless you can always be sure the inputs are from a safe user imo

PokestarFan 23 minutes ago||

If you want AI to be useful it will eventually encounter untrusted content, such as via web search. I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

savanaly 21 minutes ago||

>I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

It also wouldn't work. You would simply mindjack the outer AI and have it mindjack the inner AI in turn with its summary. Nesting AIs can't fix the malicious input problem.

santadays 16 minutes ago||

Just pass that through a third llm.

hahahaa 52 minutes ago||

> The victim uploads a file to Rovo that contains a hidden prompt injection

Yeah this attack is possible on all modern agentic systems.

* Access to your private data

* Exposure to untrusted content

* The ability to externally communicate in a way that could be used to steal your data

(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)

And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.

pram 2 hours ago||

I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere.

It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.

jerf 1 hour ago||

Rovo has my favorite example of AI misfeature. Just checked, it's still there in Cloud Confluence. In Edit mode for a page, you can select a range of text and a menu will pop up, with Ask Rovo being a drop down on it. There's a few good options... Improve Formatting, translation options, Make Shorter...

... but it also has Make Longer. Yes, a built-in feature to type some text in, and the use the mighty power of AI to bloat it.

Naturally, you can repeat this process several times on the same text, for your own little personal demonstration of what model collapse looks like in real time.

edaemon 1 hour ago|||

Don't worry, you can use Rovo to summarize the document! That way you can get the information your coworker wanted to share but filtered through a game of teLLMephone.

perpetuallunch 21 minutes ago||

We’ve gone from proof-of-work to proof-of-no-work.

pan69 1 hour ago|||

What's even worse is that, when you do this on the description of a story or task, everytime it comes up with a slightly different format of how it's going to layout the "enhanced" description.

verdverm 1 hour ago||

Have you seen the markdown agent instructions they provide in their new agentic `twg` cli? 70k tokens one average, there are more than one...

Rovo is the worse Ai I have used, I suggested they stop trying and let us have model choice. Save money and don't do things out of their skill sets

john_strinlai 2 hours ago||

~every ai vulnerability write up boils down to "just ask it do to the thing", but with fancier terms like "indirect prompt injection".

ExoticPearTree 52 minutes ago||

Rovo is funny. It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.

alexaholic 35 minutes ago||

Fwiw Rovo is built on top of Claude

consp 2 hours ago||

It's nice they force rovo now for document/version diff's. Because you need to burn down the rainforest for those. (sarcasm ... for obvious reasons)

formerly_proven 2 hours ago||

> Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. When Rovo calls the insecure tool to open the URL, the attacker's site logs the request, including the appended sensitive data.

mvdtnz 43 minutes ago|

> Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

Wow, great work Atlassian. The web search setting does not disable web search.

More comments...