Two separate security research teams found, through completely different attack paths, that Atlassian's Rovo AI assistant can be manipulated into pulling data a user has access to and sending it to an outside server, without that user ever intending to share it. PromptArmor's version hides malicious instructions inside a document: a user uploads a file and asks Rovo to help organize their Jira tickets, and text buried in that file gets interpreted by the model as a command, causing Rovo to gather ticket and page contents and quietly append them to a URL it then opens itself, delivering the data straight into an attacker's server logs. Turning off Rovo's web-search setting did not stop it, because the exfiltration used a separate URL-fetching capability that the setting does not cover, a good illustration of how granular AI safety toggles often do not cover every path data can leave through. Varonis found a second, unrelated route: a URL parameter that could preload a full prompt into Rovo Chat, so one click on an attacker's link was enough to make Rovo run arbitrary instructions with the clicking user's own permissions and ship the results out. That one has been fixed server-side by Atlassian and paid out as a bug bounty; the document-based one had not received a confirmed fix as of its August 5 disclosure. Neither bug breaks Atlassian's permission model, the assistant only ever touches data the signed-in user could already see, which is exactly the point: wiring an AI agent across a company's ticketing and documentation with a user's full permissions turns 'can this user read the data' into 'can anything this user opens make an AI agent read the data on their behalf and hand it to someone else.' For anyone rolling out AI assistants inside enterprise SaaS tools, this is a concrete case for scoping which teams get access before rollout rather than treating a single web-search toggle as the security boundary.