The detail I keep chewing on isn’t the exfiltration itself — it’s that the org-wide “Enable web search” toggle was off and the attack worked anyway. The setting removed the search, but left the tool that opens results. That’s not a bypass in any clever sense. That’s a control that describes an intention rather than enforcing one.
I run enough self-hosted things to have a reflex here: when I turn something off, I want to see it gone from the tool list, not greyed out in a settings pane. Any agent I wire up gets audited the same way I check a shore power connection — I don’t trust the switch, I look at whether current is actually flowing. If your agent can build a URL from data it just read and then fetch that URL, you have an exfiltration channel, full stop. The injection doesn’t need to come from the web; a file someone downloaded and uploaded is enough.
So: assume every document your agent touches is hostile input, and treat outbound fetch as the thing to constrain, not the input.
The story — PromptArmor documented vulnerabilities in Atlassian’s Rovo AI agent that allow data exfiltration across a tenant — Jira tickets, Confluence docs — via indirect prompt injection, with no human approval step. Rovo’s URL retrieval tool has no protections against opening URLs the agent dynamically constructs, so an injection can append sensitive data to an attacker’s URL and have Rovo fetch it, logging the contents server-side. Reopening the chat later shows no evidence. Rovo also renders Markdown images from AI output, a second known exfiltration vector. PromptArmor disclosed on May 23, 2026; Atlassian assigned a case number on May 25 and, after follow-ups on June 4 and July 29, has not communicated further. Rovo remains vulnerable as of publication. (Source)