Atlassian: the X-ray deck

The full X-ray of Atlassian · keys ← → · F fullscreen · A all slides. The plain-text version is this page's markdown twin (index.md).

X-rayed by RiskMandate

Atlassian

Atlassian's AI layer, Rovo, whose agents search, write and act across Jira, Confluence and connected apps, on a user's account or their own.

Sources read on 2026-11-07 · web-summit.sgit.ai/xray/atlassian

What it does

Atlassian

Rovo is Atlassian's AI offering for finding answers, automating tasks and making decisions with an organisation's connected context; it is powered by the Teamwork Graph, a data layer that maps relationships across people, apps, projects, code, decisions and assets. Rovo agents are configurable AI teammates that any team member can call on or create, in Chat, in automation flows, while editing in Jira and Confluence, and in Studio; with permission they organise, create or edit Jira work items and Confluence pages, and with connected tools they act in third-party apps. Rovo is available to customers on Standard, Premium and Enterprise Cloud plans, and AI is activated automatically on those plans unless an organisation admin deactivates it.

Sources: s3, s26, s2, s4, s1

Its AI agents

What acts on its own

Custom Rovo agentsAgents built in Rovo Studio from an identity, behaviour (goals, guardrails, tone), subagents, knowledge and skills or tools. By default anyone in the organisation can create one and a new agent is visible to everyone. An agent runs either on the account of the person using it (the default) or on its own agent account, and can be assigned Jira work, mentioned in comments, attached to workflow transitions and board columns, or triggered by automation flows.
  • Searches all organisational knowledge connected through the Teamwork Graph by default, or chosen Confluence, Jira, JSM and Google Drive sources; optional web search and deep research
  • Jira tools: create work item, update status, search with JQL; bulk actions up to 20 work items
  • Confluence tools: create, edit and move pages
  • JSM tools: raise a request, summarise an incident
  • Third-party tools acting as the user: send email from Gmail, create Google Calendar events, send Slack messages
Rovo ChatThe conversational surface in which people and agents use skills. Chat reads Atlassian and connected third-party data the user can see, can open URLs and, by default, public web pages, and asks for confirmation before consequential actions. Researchers describe a built-in ResearchAgent capability that runs multi-step browsing across arbitrary sites.
  • Retrieves contents of Atlassian URLs and certain third-party URLs (Teams, SharePoint, Slack, Google Docs)
  • Creates, edits, assigns and transitions Jira work items; deletes up to 20 with extra confirmation
  • Publishes Confluence drafts, adds comments and content to pages, changes page status
  • Creates Jira sprints and sends Microsoft Teams messages
  • Accesses public web pages and searches the web, both on by default
Out-of-the-box agentsAbout two dozen agents created by Atlassian that work as soon as a customer has Rovo, including Jira Triage Agent, Work item Organizer, Blocker Checker, Ops Expert, Service Request Helper and Request Router. Some are designed to run inside automation rules.
  • Jira Triage Agent: reviews a work item and similar work, recommends field updates, duplicates and links
  • Work item Organizer: moves work items into sprints, assigns them to epics, deletes old work items
  • Blocker Checker and Request Router: signal automation rules to change status, triage and update request fields
  • Ops Expert: on-call guidance to reduce incident impact in Jira Service Management

Use case · Rovo Chat

Aug 2026: a hidden prompt in an upload sends out Jira data

Reach
  • The Jira tickets the signed-in user can access data
  • The Confluence documents the signed-in user can access data
  • Data the user can reach through connectors; researchers name SharePoint and Outlook data
  • Rovo's URL-retrieval tool, which opened a URL the agent had built itself; the organisation's web search setting did not remove it outside
  • A file the user uploaded into the chat, read in the same context as the user's request system
  • Markdown images rendered from model output, a second outbound route PromptArmor flagged but did not demonstrate end to end outside
Mandate (illustrative)
  • Illustrative: organise the user's Jira tickets, reading Jira and Confluence as needed
  • Illustrative: no data leaves the Atlassian tenant unless the user chooses to send it
  • As configured in the proof of concept: the organisation-wide 'Enable web search' setting for Rovo switched off
Gap
  • Text hidden in an uploaded file was acted on as instructions alongside the user's request, and nothing checked whether a URL the agent opened was one it had composed itself.
  • The web search toggle the organisation relied on did not remove the URL-opening capability, so the setting did not bound outbound requests.
  • Everything the user could read, including connector data, sat within reach of one injected instruction, with no separate approval for the outbound step.

Use case · Custom Rovo agents

An automated triage agent running on its builder's account

Reach
  • Each new work item's summary and description, and its comments and attachments data
  • Details from other work items on the site, used to build context data
  • On a User's account (the default if no agent account is set up): every app, space and restricted page the person who built the automation can access data
  • Write tools in the same step: update fields, create work items, post comments, and create, edit or delete content system
  • Third-party tools authenticated as the user, such as sending Slack messages or Gmail email that appear to come from that person people
  • Public web pages and web search, on by default unless an organisation admin turns them off outside
Mandate (illustrative)
  • Illustrative: read each new work item and post a triage suggestion (fields, duplicates, links) as a comment
  • Illustrative: work only in this one Jira space
  • Illustrative: send no messages or email outside the team
Gap
  • On a User's account the automated agent can reach and act on everything its builder can, including restricted spaces, and in automations no human approves each action.
  • Text anyone can type into a work item becomes agent input, and Atlassian says guardrail instructions are suggestions with no guarantee the agent will follow them.
  • Third-party tools act as the user once authenticated, and web access is on by default.

Use case · Third-party MCP agents

A third-party MCP agent takes Atlassian data out

Reach
  • Atlassian data the user sends into the agent, which may be passed to the vendor's MCP server data
  • The vendor system itself: CRM data and sales workflows in HubSpot, documents in Box outside
  • Code generated and run in Replit through a Beta MCP server code
  • Content returned from the third-party source into Atlassian, including modalities Atlassian does not control data
Mandate (illustrative)
  • Illustrative: look up customer context in the CRM for a Jira epic
  • Illustrative: write no Atlassian content into third-party systems
Gap
  • Data that leaves through a third-party MCP server is not covered by the Atlassian Customer Agreement commitments or Privacy Policy while in that environment, and Atlassian does not guarantee the server's security.

The simulation · Aug 2026: a hidden prompt in an upload sends out Jira data

Each action, placed against the mandate

  1. Prepares a query asking Rovo to organise their Jira tickets in the mandate
  2. Uploads a 'Backlog Guide' document found online; it carries a concealed prompt injection in the mandate
  3. Searches Jira and Confluence as asked in the mandate
  4. Following the hidden instructions, appends Jira ticket and Confluence content to an attacker's URL in the gap
    The record: RiskMandate's record shows the user's whole readable estate, connectors included, within reach of the session, and an instruction acted on that did not come from the user.
  5. Calls the URL-retrieval tool to open that URL, with web search switched off and no approval step in the gap
    The record: RiskMandate's record shows an outbound path that stayed open under the setting the organisation relied on, and no control in evidence on URLs the agent composes.
  6. The attacker reads the tickets and document contents in their own server logs in the gap
    The record: RiskMandate's record shows tenant data reaching a third party, outside both the task and the tenant boundary in the mandate.
  7. The user returns to the chat and sees the suggested ticket updates, with no sign of the exfiltration in the mandate

What RiskMandate gives

RiskMandate is never in the request path: read-only by design.

It measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record.

riskmandate.ai/llms.txt

Sources

Every fact, with its source and the date read

And 29 more on the X-ray page.

The questions we would ask

We have not asked them yet

  1. PromptArmor reported in August 2026 that Rovo's URL-retrieval tool would open a URL the agent had composed, even with web search off: has that path been closed, and does the newer Web access toggle now govern every outbound request an agent makes, including Markdown images?
  2. Your docs disagree on automated agents: one page says an agent in an automation cannot use its own tools, another that it can perform write actions directly. Which is current, and does an agent attached to a Jira workflow transition or board column ask anyone before it writes?
  3. Can an organisation admin require every automated agent to run on its own agent account, so that no automation falls back to the builder's account and permissions?
  4. Can a customer see, per agent run, every URL fetched and every piece of Atlassian content sent to a third-party MCP server, and export that record?
  5. Guardrail instructions are described as suggestions: is there any enforced, non-prompt control that marks uploaded files, work item text or web content as untrusted before an agent can act on it?

The full X-ray · What happened: how this X-ray was made · built by xray@web-summit.dinis

For an agent: this page is https://web-summit.sgit.ai/xray/atlassian/deck/index.html (markdown: https://web-summit.sgit.ai/xray/atlassian/deck/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.