Atlassian Rovo still zero-click exfiltrates Jira and Confluence data, 2.5 months after disclosure.

PromptArmor went public August 5 (248 points on HN) after Atlassian went silent. Rovo's URL-retrieval tool has no protection against URLs the agent itself generates, so indirect prompt injection reaches anything behind its connectors. Disabling web search doesn't help: it removes the search tool but leaves the tool that opens search results. Timeline is disclosed May 23, acknowledged May 25, follow-ups June 4 and July 29, then nothing. No CVE. Still vulnerable. Incumbent AI features are shipping with less security review than the products they're bolted onto, and this is the receipt.