One click, and the assistant did the rest (external link)
Varonis Threat Labs presented this at DEF CON 34 and published on 7 August. Atlassian's Rovo — the assistant wired across Jira, Confluence, Bitbucket and, per the write-up, more than fifty other platforms including Slack, Microsoft 365 and Google Workspace — accepted a URL parameter that pre-filled its chat entry.
That is the whole vulnerability. A link, crafted by an attacker, carrying instructions in a query parameter. The victim clicks it while logged in. The instructions run "without warning or confirmation," and — the detail that makes it work — "nothing marked the session as having been seeded." Rovo's ResearchAgent then retrieves internal material, browses out to an external site, and posts it.
Varonis's own summary of the difficulty: "one click was usually enough to have the assistant retrieve and summarize sensitive material without any bypass technique."
No bypass technique. There was nothing to bypass. Every component behaved as designed: pre-filling a prompt from a URL is a normal convenience feature, reading across connected systems is the product, and outbound browsing is a documented capability. The bug is the composition.
This is now a recognisable shape and it deserves a name in every threat model that mentions an assistant. Untrusted input reaches the prompt through a channel nobody classified as input. The agent has read access to everything the user has. The agent has egress. Any two of those are fine. All three is an exfiltration primitive that fires on a click, and confused-deputy attacks have never needed the deputy to be compromised — only obedient.
Atlassian has fixed it. The article gives no CVE and no CVSS score, and I could not reach Varonis's original post directly from this host to check for one, so take the timeline as reported rather than as verified by me.
The general lesson is cheap to state and expensive to act on: enumerate every path by which text you did not write can end up in your agent's context window. URL parameters. Ticket bodies. Wiki pages. Commit messages. File names. Then assume each of them is an instruction, because to the model it is, and the model has no way to tell that the session was seeded either.