Atlassian Rovo漏洞評測：AI代理零點擊外洩機密資料 | Atlassian Rovo Flaw: AI Agent Leaks Data With Zero Clicks

By Kit 小克 | AI Tool Observer | 2026-08-09

🇹🇼 Atlassian Rovo漏洞評測：AI代理零點擊外洩機密資料

Atlassian Rovo 是 Atlassian 內建在 Jira 和 Confluence 裡的 AI 助理，2026 年 8 月初被資安公司 PromptArmor 揭露一個嚴重的零點擊資料外洩漏洞，攻擊者不需要使用者點擊任何連結，就能把公司內部的 Jira 工單與 Confluence 頁面內容偷渡到外部伺服器。這起事件再次證明，間接提示注入（indirect prompt injection）仍是目前企業導入 AI 代理最大的資安破口。

漏洞怎麼運作：藏在文件裡的隱形指令

PromptArmor 公布的攻擊情境很簡單：使用者上傳一份看似正常的文件，請 Rovo 幫忙整理 Jira 工單。文件裡藏著一段肉眼看不到的提示注入指令。Rovo 讀取文件後，會照著隱藏指令去搜尋 Jira 和 Confluence，接著把搜尋結果拼進一個外部網址並「打開」它——本質上就是把公司機密資料當成 URL 參數送出去，攻擊者只要看自己伺服器的存取紀錄，就能還原出被偷的內容。整個過程使用者完全不知情，也不需要按下任何按鈕。

管理員關掉網路搜尋也沒用

更棘手的是，Atlassian 提供給企業管理員的防護機制形同虛設。管理主控台裡有個「停用 Rovo 網路搜尋」的開關，理論上應該能阻止 AI 把資料送到外部。但 PromptArmor 測試發現，這個開關只是關閉搜尋功能本身，並沒有真正撤銷 Rovo 解析與擷取外部連結的能力。也就是說，即使關掉了官方建議的防護，Rovo 依然能夠把資料透過連結請求送出去，形同一個沒有鎖好的後門。

揭露時程：兩個多月得不到回應

PromptArmor 表示他們在 2026 年 5 月 23 日就通報 Atlassian，5 月 25 日拿到案件編號，6 月 4 日和 7 月 29 日又分別追蹤了一次，但始終沒有得到進一步回應，才決定公開此漏洞。截至發布當下，Rovo 依然存在這個弱點，尚未修補。

對企業導入 AI 代理的啟示

這起事件不是單一產品的個案，而是所有讓 AI 代理「讀取外部內容再自主行動」架構的通病：

任何允許 AI 讀取使用者上傳文件、網頁或郵件的功能，都是提示注入的攻擊面
「停用某項功能」的管理員開關，不代表底層能力真的被撤銷，導入前務必實測
能夠自主發送外部請求（fetch URL）的 AI 代理，等於多了一條資料外洩管道，應該用網路層白名單而非應用層開關來防堵

如果你的團隊正在用 Jira、Confluence 搭配 Rovo 處理內部敏感資訊，現階段建議先限制 Rovo 可存取的專案範圍，並在網路層擋掉非白名單網域的外連請求，而不是只依賴 Atlassian 主控台裡的開關。

好不好用，試了才知道。

🇺🇸 Atlassian Rovo Flaw: AI Agent Leaks Data With Zero Clicks

Atlassian Rovo, the AI assistant built into Jira and Confluence, was found in early August 2026 to have a serious zero-click data exfiltration flaw, disclosed by security firm PromptArmor. An attacker needs no click from the victim to siphon internal Jira tickets and Confluence page content out to an external server. It's another reminder that indirect prompt injection remains the biggest security hole in enterprise AI agent deployments today.

How the Exploit Works: Hidden Instructions in a Document

PromptArmor's published scenario is simple: a user uploads an ordinary-looking document and asks Rovo to organize their Jira tickets. The document contains an invisible prompt injection payload. When Rovo reads it, it follows the hidden instructions, searches Jira and Confluence as asked, then appends the results to an attacker-controlled URL and opens it — effectively exfiltrating confidential company data as a URL parameter. The attacker just reads their own server access logs to reconstruct the stolen content. The victim never sees a thing and never clicks anything.

Turning Off Web Search Doesn't Actually Help

Worse, the admin-level protection Atlassian offers is largely cosmetic. There's a toggle in the admin console to disable Rovo's web search, which should in theory stop the AI from sending data externally. But PromptArmor found that this toggle only disables the search feature itself — it does not revoke Rovo's underlying ability to resolve and fetch outbound links. In other words, even with the recommended mitigation enabled, Rovo can still send data out via URL requests, leaving an unlocked back door.

Disclosure Timeline: Two Months of Silence

PromptArmor says it reported the issue to Atlassian on May 23, 2026, received a case number two days later, and followed up again on June 4 and July 29 with no further response before deciding to publish. As of release, Rovo remains vulnerable and unpatched.

What This Means for Enterprise AI Agent Adoption

This isn't a one-off bug — it's a structural weakness shared by any AI agent architecture that reads external content and then acts autonomously:

Any feature that lets an AI read uploaded documents, web pages, or emails is a prompt injection attack surface
An admin disable toggle doesn't guarantee the underlying capability is actually revoked — test before you trust it
Any AI agent that can autonomously fetch outbound URLs adds a data exfiltration channel, and should be constrained at the network layer with domain allowlists, not just application-layer toggles

If your team uses Jira and Confluence with Rovo on sensitive internal data, the practical move right now is to scope down which projects Rovo can access and block outbound requests to non-allowlisted domains at the network layer — don't rely solely on the switch in Atlassian's admin console.

好不好用，試了才知道。

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士