A disabled control did not disable anything, and the chat log shows no trace

A user uploads a document carrying a hidden injection and asks Rovo to organize their Jira tickets. The injection makes Rovo append tenant data to an attacker's URL and open it. PromptArmor's writeup states the mechanism plainly: "there are no protections against opening a URL that has been dynamically created by the agent," and the chain runs "without requiring any human-in-the-loop approval." The org-level control does not help, and the report says why: "the web search setting fails to remove the tool for opening the search results." The screenshot in the piece shows that setting toggled off.

The report also notes twice in its own words that the evidence disappears: "If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack." PromptArmor's dated timeline records disclosure on May 23, an Atlassian acknowledgement and case number on May 25, follow-ups on June 4 and July 29, and publication on August 5 with the product still vulnerable. The Hacker News thread stood at 124 points and 39 comments at roughly 4.8 hours as observed between 18:06 and 18:35 EDT. In that thread Simon Willison proposed a deterministic counter: a URL retrieval tool should fetch only URLs a user typed or a trusted tool returned, and should block any the agent concatenated itself.

Why it matters: the back pressure most teams actually run is a person reading the transcript. Here the tool layer failed and the review layer failed with it, because the transcript reconstructs clean. Note also that PromptArmor sells prompt injection defence, so this is research and marketing at once, and there is no independent reproduction and no Atlassian statement.