Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. In the firm's published example, a user uploads a document carrying a concealed injection and asks Rovo to organize their Jira tickets. The rovoChatPrompt parameter could carry a full prompt in a Rovo URL. Permissions, and what can be switched offRovo's data access follows permissions configured in Atlassian products and connected third-party apps. Rovo Search, Chat and Create with Rovo stay available as long as any Jira app on that site still has Rovo enabled.