Atlassian Rovo Exfiltrates Data, Bypassing Controls • Hacker News Board

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#21

Post by busterarm » Wed, Aug 05, 2026, 7:51 PM UTC

walrus01 wrote: post #13

yborg wrote: post #8

Earlier quoted context omitted.

You'd have to look at their profit numbers. They have a huge captive base of customers, like Adobe it might take decades for things to get bad enough and alternatives to arise before their profitability is impacted. And the executives who benefit will have cashed out long before then.

Recently saw an example of somebody who vibe coded a tool to mass export the contents of a 'Confluence' wiki into an instance of self hosted mediawiki, preserving everything. Mediawiki as a whole has a feature set that 95% of organizations will only scratch the surface of. There's a ridiculous number of possible plugins and customization if you have somebody who knows what they're doing with it. The majority of compa…

I've been at more than one company that migrated _from_ MediaWiki to Confluence. It usually boils down to "non-developers have to use this and Markdown+plugins is hard".

Turns out no matter how much better the thing is, the users have to know what they're doing more than the operators do.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#22

Post by nemomarx » Wed, Aug 05, 2026, 7:52 PM UTC

htrp wrote: post #16

I feel like prompt armor writes the exact same blog post for every agentic tool because they all suffer from the ignore previous instructions prompt injections. https://www.promptarmor.com/resources/claude-cowork-exfiltra... https://www.promptarmor.com/resources/google-antigravity-exf... https://promptarmor.substack.com/p/data-exfiltration-from-sl... https://www.promptarmor.com/resources/gpt-for-google-sheets-... htt…

How could they not? If some lab had a method to make really secure guard rails or avoid prompt injection thoroughly I think they would be trumpeting it. But the basic mechanics of language models are vulnerable to this unless you can always be sure the inputs are from a safe user imo

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#23

Post by hahahaa » Wed, Aug 05, 2026, 7:54 PM UTC

> The victim uploads a file to Rovo that contains a hidden prompt injection

Yeah this attack is possible on all modern agentic systems.

* Access to your private data

* Exposure to untrusted content

* The ability to externally communicate in a way that could be used to steal your data

(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-age...)

And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#24

Post by ExoticPearTree » Wed, Aug 05, 2026, 7:54 PM UTC

Rovo is funny. It downloads everything it can do Atlassian servers for "analysis". And you're pretty much screwed if you link it to Google Docs or Sharepoint. How do I know this? "Why is an AWS IP downloading all our docs?" question I got about a month ago.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#25

Post by mvdtnz » Wed, Aug 05, 2026, 8:02 PM UTC

> Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

Wow, great work Atlassian. The web search setting does not disable web search.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#26

Post by alexaholic » Wed, Aug 05, 2026, 8:10 PM UTC

Fwiw Rovo is built on top of Claude

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#27

Post by automatic6131 » Wed, Aug 05, 2026, 8:13 PM UTC

Ahh yes: "when you Rovo, you oh-no my data"

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#28

Post by PokestarFan » Wed, Aug 05, 2026, 8:23 PM UTC

nemomarx wrote: post #22

htrp wrote: post #16

I feel like prompt armor writes the exact same blog post for every agentic tool because they all suffer from the ignore previous instructions prompt injections. https://www.promptarmor.com/resources/claude-cowork-exfiltra... https://www.promptarmor.com/resources/google-antigravity-exf... https://promptarmor.substack.com/p/data-exfiltration-from-sl... https://www.promptarmor.com/resources/gpt-for-google-sheets-... htt…

How could they not? If some lab had a method to make really secure guard rails or avoid prompt injection thoroughly I think they would be trumpeting it. But the basic mechanics of language models are vulnerable to this unless you can always be sure the inputs are from a safe user imo

If you want AI to be useful it will eventually encounter untrusted content, such as via web search. I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#29

Post by perpetuallunch » Wed, Aug 05, 2026, 8:25 PM UTC

edaemon wrote: post #17

jerf wrote: post #12

Earlier quoted context omitted.

Rovo has my favorite example of AI misfeature. Just checked, it's still there in Cloud Confluence. In Edit mode for a page, you can select a range of text and a menu will pop up, with Ask Rovo being a drop down on it. There's a few good options... Improve Formatting, translation options, Make Shorter... ... but it also has Make Longer. Yes, a built-in feature to type some text in, and the use the mighty power of AI t…

Don't worry, you can use Rovo to summarize the document! That way you can get the information your coworker wanted to share but filtered through a game of teLLMephone.

We’ve gone from proof-of-work to proof-of-no-work.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#30

Post by savanaly » Wed, Aug 05, 2026, 8:25 PM UTC

PokestarFan wrote: post #28

nemomarx wrote: post #22

Earlier quoted context omitted.

How could they not? If some lab had a method to make really secure guard rails or avoid prompt injection thoroughly I think they would be trumpeting it. But the basic mechanics of language models are vulnerable to this unless you can always be sure the inputs are from a safe user imo

If you want AI to be useful it will eventually encounter untrusted content, such as via web search. I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

>I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

It also wouldn't work. You would simply mindjack the outer AI and have it mindjack the inner AI in turn with its summary. Nesting AIs can't fix the malicious input problem.