Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Atlassian Rovo Exfiltrates Data, Bypassing Controls

promptarmor.com

Post reply on HN
Print view View original

121–130 of 147 posts

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#121

Post by [deleted] »

sph wrote: post #104
rightbyte wrote: post #103

Earlier quoted context omitted.

So they will harvest trade secrets from 10000s of companies and there have been no panic mass flight about this? How companies entrust SaaSs with their data is beyond insane to me. Especially since FOSS alternatives are readily available.

Who cares? The employee, just looking to make rent? The CEO, all in on the dream of the AI powered future? Legal, looking forward to litigation and well-competition retainers? Atlassian itself, when it’s just one of the many companies training models on private intellectual property, and whose T&C clearly state they will be doing so? Competitors, when there will be no reasonable way to prove their code has been gener…

[deleted]

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#122

Post by znnajdla »

rightbyte wrote: post #103
kevcampb wrote: post #97

Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training. https://news.ycombinator.com/item?id=47833247 This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.

So they will harvest trade secrets from 10000s of companies and there have been no panic mass flight about this? How companies entrust SaaSs with their data is beyond insane to me. Especially since FOSS alternatives are readily available.

Very few companies actually have any “trade secrets”. The success of almost any business is based on marketing and distribution and reputation and partnerships, not on any “secret”.

It's one of the classic mistakes of people who are not entrepreneurs. They try to keep things too secret and they spend a lot of time and effort keeping things secret while real entrepreneurs who have actually made millions on the market know secrecy rarely matters.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#123

Post by Schlagbohrer »

pram wrote: post #5

I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere. It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.

"has made web browsing way slower while all the junk is loading" describes all web development since the 90s

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#124

Post by simonw »

wunderwuzzi23 wrote: post #117
simonw wrote: post #36

> Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. I think it was Anthropic that first introduced a pattern that completely locks this down: your URL retrieval tool should only work for URLs that have previously been typed into the conversation by a user or have…

One of the latest mitigations is to make sure that a URL an agent visits has been indexed by a search engine crawler. At least that is what OpenAI does now in ChatGPT. That makes sure that not a large amount of private data is leaked in one request. Assuming that if a URL is indexed, it is public data. However, there are still bypasses with using many requests to leak information, like a request per character of pre-…

Yeah, the letter-by-letter and dynamic tools that construct longer URLs tricks are both important to know about. I wrote about the latter of those here: https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfil...

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#125

Post by prmoustache »

itomato wrote: post #119
prmoustache wrote: post #118

Do people put secrets in Atlassian tools? Sounds like the worst place to do that. If anything I would want my main wiki/project/ticket management tools/code repos to be as open as possible (I mean to read) to help collaboration. The part about not having guardrail against calls to external urls is wild though.

Not "secrets" usually, but people tend to consider the corporate IP embodied in Jira to be classified as something other than Public. Teamwork Graph exposes all the people working on stealth products with code names right alongside their other work anyway.

I was thinking within the scope of a single tenant which is the scope of the prompt injections issues mentionned in this article.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#126

Post by monster_truck »

devmor wrote: post #53
simonw wrote: post #36

> Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. I think it was Anthropic that first introduced a pattern that completely locks this down: your URL retrieval tool should only work for URLs that have previously been typed into the conversation by a user or have…

Determinism is a terrifying word to people who want to believe their LLM has a little brain and can do anything they want it to.

A wild number of people who present themselves as knowledgeable or even experts on the subject either have no idea or worse, do not believe that it is possible to ie set a static seed value and send the same prompt across multiple fresh contexts and get the same result*

It's genuinely a little concerning. It does not help that many of them are gaslighting themselves into thinking these things are benchmark crushing elite hackers by running effectively unsecured, unfiltered, unlogged production environments.

*Obviously this also means a temperature of >0 to avoid the greedy trap, the same generation params, on the same software, hardware, drivers etc etc

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#127

Post by threecheese »

well_ackshually wrote: post #109
pram wrote: post #5

I can’t get over how bad “Rovo” is. Somehow more aggressive and useless than Microsoft putting “Copilot” everywhere. It’s objectively worse than using something like Cowork + MCP, AND they injected it into every single page on JIRA and Confluent which has made web browsing way slower while all the junk is loading.

Rovo makes for an INCREDIBLE time reading jira tickets and confluence pages. Someone wrote YES in all caps in a page ? Rovo will helpfully tell you (after loading for 5 seconds) that YES stands for Yassified Entertainment Setting, a new option added to the app in January 2024. Whenever I feel like I'm bad at software development, I look at Atlassian and I feel good.

I’ve been adding a “terms” section to every AI-used project due to these hallucinations. We abbreviate our company name eeeeverywhere and even Opus gets this wrong constantly. Obv I’m not adding “YES==yes” but that’s hilarious!

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#128

Post by dylan604 »

znnajdla wrote: post #122
rightbyte wrote: post #103

Earlier quoted context omitted.

So they will harvest trade secrets from 10000s of companies and there have been no panic mass flight about this? How companies entrust SaaSs with their data is beyond insane to me. Especially since FOSS alternatives are readily available.

Very few companies actually have any “trade secrets”. The success of almost any business is based on marketing and distribution and reputation and partnerships, not on any “secret”. It's one of the classic mistakes of people who are not entrepreneurs. They try to keep things too secret and they spend a lot of time and effort keeping things secret while real entrepreneurs who have actually made millions on the market…

In the realm of apps and stuff, it is pretty much just repacking of someone else's idea.

In the world of B2B, there are definitely companies that provide service based on direct personal experience of senior employees. While they may be using the same software available to others, it's the logic to know what to tell that same ol' software what to do that matters. Over my entire career I have dealt with multiple companies that write code but have zero knowledge about the subject matter the code is being written for so that basic mistakes are made resulting in utterly ineffective software.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#129

Post by Nextgrid »

rightbyte wrote: post #103
kevcampb wrote: post #97

Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training. https://news.ycombinator.com/item?id=47833247 This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.

So they will harvest trade secrets from 10000s of companies and there have been no panic mass flight about this? How companies entrust SaaSs with their data is beyond insane to me. Especially since FOSS alternatives are readily available.

Companies that have something worth protecting already don't use it and/or pay for the on-prem version.

The rest don't have anything worth stealing anyway.

Re: Atlassian Rovo Exfiltrates Data, Bypassing Controls

#130

Post by Nextgrid »

mystifyingpoi wrote: post #93
jerf wrote: post #12

Earlier quoted context omitted.

Rovo has my favorite example of AI misfeature. Just checked, it's still there in Cloud Confluence. In Edit mode for a page, you can select a range of text and a menu will pop up, with Ask Rovo being a drop down on it. There's a few good options... Improve Formatting, translation options, Make Shorter... ... but it also has Make Longer. Yes, a built-in feature to type some text in, and the use the mighty power of AI t…

That's some hillarious misnaming, I love it. It probably was meant to be something like "make more comprehensible, use simpler language but more words" and we got this.

But for their target market, corporate office drones writing crap that nobody will ever read more than once (if even that), this is actually perfect and makes AI usage numbers go up. "Make longer" is amazing for someone who just wants to pretend they put more effort than they actually did.

(of course, everyone else can do that too, and the length/literacy of prose is no longer a good proxy for effort. In nature, "honest signalling" only works if the signal is costly. Removing the cost from the signal makes the signal worthless)

Post reply on HN