First ask the model to find and strip hidden commands in external text, then run the task: attack success drops from 70-80% to <1%. Lab score 94/100

L'essentiel La société de sécurité PromptArmor a documenté une injection de prompt indirecte dans...

Assess and monitor risk from AI in vendors with novel intelligence on emerging threats. Stay ahead of AI-driven third-party risk with continuous moitoring and adaptive insight.

Attacker-controlled instructions can make Atlassian's Rovo assistant collect Jira or Confluence data that a signed-in user can access, then send it to an outside server. Two security firms found that behavior independently, by different routes. Only one of those routes is confirmed closed. PromptArmor, an AI security firm, hid the instructions in content Rovo reads. It said an uploaded file was

Ah, encore une merveilleuse petite faille de sécurité qui va ravir tous les paranos de la vie privée et les anti-IA ^^ ! Johann Rehberger et l'équipe de PromptArmor viennent de démontrer comment Claude Cowork , l'agent IA d'Anthropic censé vous simplifier la vie au bureau, peut se transformer en aspirateur à fichiers personnels. J'imagine que si vous l'avez testé, vous avez un dossier connecté à Claude Cowork pour qu'il vous aide à analyser vos documents ? Parfait. Il suffit maintenant qu'un petit malin glisse un fichier Word contenant des instructions cachées, et hop hop hop, vos précieux fichiers partent se balader sur un serveur distant sans que vous n'ayez rien vu venir.

Ah, encore une merveilleuse petite faille de sécurité qui va ravir tous les paranos de la vie privée et les anti-IA ^^ ! Johann Rehberger et l'équipe de PromptArmor viennent de démontrer comment Claude Cowork , l'agent IA d'Anthropic censé vous simplifier la vie au bureau, peut se transformer en aspirateur à fichiers personnels. J'imagine que si vous l'avez testé, vous avez un dossier connecté à Claude Cowork pour qu'il vous aide à analyser vos documents ? Parfait. Il suffit maintenant qu'un petit malin glisse un fichier Word contenant des instructions cachées, et hop hop hop, vos précieux fichiers partent se balader sur un serveur distant sans que vous n'ayez rien vu venir. En fait, le fichier piégé contient du texte invisible pour l'œil humain, mais parfaitement lisible par l'IA. Genre une police en taille 1px, de couleur blanche sur fond blanc, avec un interligne de 0,1 histoire d'être vraiment sûr que personne ne le remarque. C'est beau la créativité des hackers, quand même. Et l'IA, elle, lit tout ça comme si c'était normal et exécute gentiment les instructions malveillantes. La chaîne d'attaque se déroule en cinq étapes bien huilées. D'abord, l'attaquant dépose son fichier vérolé dans un dossier partagé auquel Claude a accès. Ensuite, il attend qu'un utilisateur demande à l'IA d'analyser le contenu de ce dossier. Claude traite alors le fichier piégé et découvre les instructions cachées. L'IA effectue une requête qui envoie vos fichiers vers l'API Anthropic... sauf que les identifiants utilisés appartiennent à l'attaquant. Vos données atterrissent donc tranquillement dans son compte, sans que vous n'ayez la moindre notification. Ce qui rend cette attaque particulièrement sournoise, c'est que la sandbox de Claude autorise les requêtes sortantes vers l'API d'Anthropic. Normal, me direz-vous, c'est son propre écosystème. Sauf que du coup, un attaquant bien motivé peut exploiter cette confiance aveugle pour faire transiter des données volées par un canal parfaitement légitime en apparence. Si vous suivez les vulnérabilités des systèmes RAG comme ConfusedPilot , vous reconnaîtrez le même genre de manipulation par injection de contenu. Et ce n'est pas tout ! Les chercheurs ont également identifié un vecteur potentiel de déni de service. En créant un fichier avec une extension qui ne correspond pas à son contenu réel, genre un fichier texte déguisé en PDF, on peut provoquer des erreurs en cascade qui paralysent l'API de manière persistante. Sympa pour bloquer un concurrent ou saboter un projet. Côté modèles affectés, les chercheurs ont démontré la vulnérabilité sur plusieurs versions de Claude, dont Haiku. Bref, c'est du sérieux. Pour ceux qui s'intéressent aux failles de sécurité des assistants IA ou aux techniques de red teaming sur les LLM , cette recherche vaut vraiment le détour. Anthropic a été notifié et travaille sur des correctifs. En attendant, si vous utilisez Claude Cowork avec des dossiers partagés, méfiez-vous de tout fichier qui pourrait traîner là sans raison apparente. Et la prochaine fois que quelqu'un vous envoie un document "urgent à analyser", prenez peut-être cinq secondes pour vous demander s'il ne cache pas une petite surprise. Pour en savoir plus c'est par ici !

PromptArmor has identified a Microsoft Copilot Cowork approval gap that may expose file links through self-directed Teams or Outlook messages in Microsoft 365.

Anthropic has launched Cowork with a known data exfiltration vulnerability that researchers reported in October 2025 but remained unpatched for the January 13 release.

Atlassian Rovo prompt injection can send Jira and Confluence data to attacker servers. One path is fixed; another remained unresolved on August 5.

Connect all the things and watch what happens

: Prompt injection lets risky commands slip past guardrails

Whack yakety-yak app chaps rapped for security crack

Authors: PromptArmor

  Atlassian's Rovo AI assistant has been exposed to two independent attack techniques that could cause it to retrieve Jira and Confluence data accessible to an authenticated user and transmit the information to an attacker-controlled server. AI security firm PromptArmor and Varonis Threat Labs identified the techniques through different attack paths. Varonis' RovoBlast vulnerability has been fixed by Atlassian, while PromptArmor said its separate content-based attack remained exploitable when it published its findings on August 5, 2026. Neither finding demonstrated a direct bypass of Jira or Confluence permissions. Instead, both attacks abused the legitimate access available to a victim's Rovo session. Malicious content can manipulate Rovo PromptArmor demonstrated an indirect prompt-injection attack in which attacker-controlled instructions were embedded inside content processed by Rovo. In its example, a user uploaded a malicious document and asked Rovo to organize Jira tickets. The concealed instructions directed the assistant to search Jira and Confluence, collect information available to the user and place the results into an attacker-controlled URL request. The attacker could then recover the stolen ticket and page contents through server logs. PromptArmor said the victim would later see the expected ticket suggestions without an obvious indication that information had also been transmitted externally. The attack was not entirely zero-click, as the victim still had to expose Rovo to the malicious content and initiate a normal request. However, the subsequent exfiltration did not require a separate human approval step. The firm also reported that disabling Rovo's web-search capability did not prevent its demonstrated attack because the exfiltration relied on a separate URL-retrieval capability. PromptArmor identified the lack of a control preventing Rovo from opening a URL constructed by the model as a root cause. It also noted that Rovo can render Markdown images from model output, which could provide another potential route for data leakage, although the firm did not demonstrate a complete Rovo attack through that mechanism. PromptArmor said it disclosed the issue to Atlassian on May 23, followed up on June 4 and July 29, and published after reporting no further communication. Its disclosure did not establish whether the content-based attack was remediated after publication. RovoBlast used a malicious link Varonis discovered a separate vulnerability involving Rovo's "rovoChatPrompt" URL parameter. An attacker could place instructions directly into a specially crafted Rovo Chat link. When an authenticated user clicked the link, Rovo would load the attacker-controlled prompt and execute it using the user's existing permissions. Varonis demonstrated the technique by instructing Rovo to retrieve sensitive information, place it into an attacker-controlled image URL and fetch the resource, thereby sending the data to the attacker. The researchers successfully exfiltrated a private API key stored in Confluence. They also tested the technique against Jira information and data accessible through SharePoint and Outlook connectors. The vulnerability, dubbed RovoBlast, was reported through Bugcrowd, received a P2 priority rating and earned a $6,000 bounty. Bugcrowd records Atlassian as deploying a server-side fix on July 8, 2026, after which the researcher validated the remediation and the report was marked resolved. Enterprise permissions remain central to the risk Rovo operates across Atlassian products and can incorporate information from connected third-party applications. Atlassian says Rovo access follows the permissions available to the user, meaning the demonstrations did not provide attackers with unrestricted tenant access. However, the findings expose a different problem: an attacker can attempt to make the AI assistant use a victim's legitimate permissions for an unintended purpose. Atlassian provides administrators with controls to restrict Rovo by application and, for Enterprise customers, by user group. Rovo is available on Standard, Premium and Enterprise Cloud plans, while disabling Rovo for one Jira-family application may not remove shared Rovo Search, Chat and Create capabilities if another Jira application on the same site still has Rovo enabled. Neither disclosure reported confirmed exploitation against a real organization, and neither issue has a CVE or entry in CISA's Known Exploited Vulnerabilities catalog as of August 8. The immediate status is therefore split: Atlassian has confirmed the RovoBlast link vulnerability is closed, while the post-publication status of PromptArmor's separate content-borne attack remains unconfirmed. Organizations using Rovo should review which applications, user groups and third-party connectors have access, tighten underlying data permissions and avoid treating the web-search setting alone as a complete defense against AI-assisted data exfiltration.

Two independent findings showed that Atlassian’s Rovo assistant could be manipulated to collect Jira or Confluence data a signed-in user can access and send it to an attacker-controlled server. Varonis’ one-click link flaw, named RovoBlast, was fixed server-side on July 8, 2026, while PromptArmor’s content-borne injection path remained unconfirmed as of...

PromptArmor: How an indirect prompt injection can manipulate Google's Antigravity IDE to invoke a malicious browser subagent and exfiltrate data; Google is working on a fix  —  An indirect prompt injection in an implementation blog can manipulate Antigravity to invoke a malicious browser subagent in order …

Attackers can exploit insecure defaults and prompt injection vulnerabilities to turn normal agent behavior into a silent data-exfiltration pipeline. The core issue is not just confusing the AI model; it is manipulating the agent to steal sensitive information without requiring any user interaction. The most alarming demonstration comes from security firm PromptArmor. They revealed how an attacker can force an OpenClaw agent to leak data using a technique called indirect prompt injection combined with messaging app features. 0-Click Attack Chain An attacker hides malicious instructions inside content that the AI agent is expected to read. The agent processes the instructions and generates a URL controlled by the attacker. The agent appends sensitive data, such as API keys or private conversations, into the URL’s query parameters. The agent sends the malicious link back to the user via messaging platforms such as Telegram or Discord. Before the user even clicks the link, the messaging app automatically generates a link preview, silently fetching the URL and handing the sensitive data directly to the attacker. Because the messaging app’s auto-preview feature automatically triggers an outbound HTTP request , this creates a dangerous “no-click” attack. The agent’s response itself becomes the exfiltration event. According to CNCERT, OpenClaw’s default security posture poses significant enterprise risk by allowing agents to browse, execute tasks, or interact with local files. They categorized threats into four main areas: indirect prompt injection via external data, accidental destructive actions, malicious third-party activities, and the exploitation of known product vulnerabilities. OpenClaw is highly useful because it can do real work, but this autonomy makes compromises much more damaging. Messaging integrations where auto-preview behaviors create seamless pathways for data theft . Host and container access that allows prompt manipulation to translate into real-world system actions. A skills ecosystem where unvetted or malicious extensions can drastically widen the attack surface. Proximity to stored secrets, as agents often operate near operational credentials and tokens. As OpenAI recently highlighted, once an agent can retrieve external information and act autonomously, developers must assume that untrusted content will attempt to manipulate the system. Invaders reports that security teams should treat this issue as an architectural flaw rather than a simple AI bug. To protect deployments, organizations should implement the following steps: Disable auto-preview features in Telegram, Discord, Slack , and other channels where AI agents generate URLs. Isolate OpenClaw runtimes inside tightly controlled containers and keep default management ports off the public internet. Restrict unnecessary file system access and keep credentials out of plaintext configuration files. Install agent skills only from trusted sources and manually review third-party code before enabling it. Set up network monitoring to alert on agent-generated links pointing to unfamiliar domains or unexpected DNS lookups. Ultimately, the most important question for security teams is no longer whether an AI model can be manipulated , but rather what a manipulated agent is silently capable of doing next. Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories. The post OpenClaw AI Agents Leaking Sensitive Data in Indirect Prompt Injection Attacks appeared first on Cyber Security News .

Authors: PromptArmor