研究演示里，Rovo 把可访问的工单与文档拼进网址参数外发：权限与抓取功能都没按任务收窄In a research proof of concept, Rovo sent tickets and documents it could access out through URL parameters: neither permissions nor fetching were scoped to the task

In PromptArmor's research proof of concept, Atlassian Rovo followed hidden instructions planted in a user-uploaded document and assembled Jira tickets and Confluence documents within its access scope into URL parameters under the researchers' control, sending them to the researchers' server through its URL-fetching tool; Markdown image rendering formed a second exfiltration channel. Turning off web search does not close this path: the URL-opening tool exists independently of the search switch.

As of publication (2026-08-05) there was no evidence of in-the-wild exploitation and no record of real customer data leaving. This was a research demonstration, not an actual breach.

Three excesses stack up: excess permission, since Rovo was entrusted with everything the signed-in user could see and the scope was never narrowed to the task; excess function, since the URL tool fetched generally and set no limits on URLs it generated itself; and an independent channel, since the URL-opening tool survives the search switch. The injection succeeding is not the point; being able to carry data out is.

The case therefore belongs to the Access Control layer: reach is set by permissions and egress by function, and when neither is scoped to the task, any hidden instruction can turn the agent into a courier.

Least function, scoped access: a tool that reads tickets gets only the ticket-reading interface, with scope narrowed by both task and user.

Restricted egress: outbound requests go through a bounded function that may only send to an audited domain allowlist, so a successful injection still cannot move data out.