Atlassian Rovo Exfiltrates Data, Bypassing Controls

Post by santadays » Wed, Aug 05, 2026, 8:29 PM UTC

savanaly wrote: post #30

PokestarFan wrote: post #28

Earlier quoted context omitted.

If you want AI to be useful it will eventually encounter untrusted content, such as via web search. I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit.

>I think things like web search should probably be run on a different sandboxed AI whose task is to write a summary that is then ingested by the main agent, similar to how existing sandboxing already works, but this would diminish the usefulness quite a bit. It also wouldn't work. You would simply mindjack the outer AI and have it mindjack the inner AI in turn with its summary. Nesting AIs can't fix the malicious inp…

Post by git-nebulous » Wed, Aug 05, 2026, 8:47 PM UTC

khanan wrote: post #3

Atlassian has gone from a trusted enterprise-partner to a complete shit-show in just 18 months. This surprises nobody. There will be classes taught in how to fuck up a good business and Atlassian will be the prime example. Regards, /someone who migrated 3500 users from Atlassians products recently due to their "cloud only"-bullshit.

Post by rmunn » Wed, Aug 05, 2026, 8:51 PM UTC

mosura wrote: post #11

gbalduzzi wrote: post #6

Earlier quoted context omitted.

I started to consider it a show show way earlier than 18 months ago. Jira is so terrible to use that it is hard to phantom how they are able to be paid for their product

Jira is how it is because almost any product that grows to be that flexible will develop the same problems. They failed to rearchitect it to something suitable for the inherent flexibility though, so it remains a disaster area, but one that is uniquely able to fit the whims of any manager that can then mandate it for everyone else.

Post by mosura » Wed, Aug 05, 2026, 9:16 PM UTC

rmunn wrote: post #35

mosura wrote: post #11

Earlier quoted context omitted.

Jira is how it is because almost any product that grows to be that flexible will develop the same problems. They failed to rearchitect it to something suitable for the inherent flexibility though, so it remains a disaster area, but one that is uniquely able to fit the whims of any manager that can then mandate it for everyone else.

Maybe the workflows, etc., are inherent complexity, so that any similarly-flexible product will have the same problems. But the awful client-server architecture, where anything you do takes several seconds of waiting for the client to send who-knows-what to the server and get data back, even selecting something from a dropdown... that is absolutely just Jira. A competing product would be able to deliver much, MUCH sn…

Post by _HMCB_ » Wed, Aug 05, 2026, 9:22 PM UTC

stephbook wrote: post #38

nemomarx wrote: post #22

Earlier quoted context omitted.

How could they not? If some lab had a method to make really secure guard rails or avoid prompt injection thoroughly I think they would be trumpeting it. But the basic mechanics of language models are vulnerable to this unless you can always be sure the inputs are from a safe user imo

What's so hard about having the LLM tool calls scoped to the tenant? Inject "X-Scope-I" after the LLM decided on a tool call and you're done. Easiest fix ever.