RovoBlast: one link seeds attacker instructions into an Atlassian Rovo session and its own ResearchAgent exfiltrates the data.

Varonis Threat Labs disclosed at DEF CON 34 that Rovo's rovoChatPrompt URL parameter pre-fills content straight into a victim's live AI session, and leaving the organization ID blank silently routes into the victim's default org with no warning (SecurityWeek). Rovo's built-in ResearchAgent, which can autonomously browse and navigate arbitrary sites, then pulls internal Jira, Confluence, and SharePoint content and pushes it to the open web in one automated chain. Varonis calls the class parameter-to-prompt injection, the same pattern they reported in Microsoft Copilot as Reprompt in January. Atlassian fixed it before publication. If your agent product accepts prompt content via URL parameter, you have this bug.