AI agent security is already broken before it scales

Atlassian's Rovo agent was caught exfiltrating sensitive data via indirect prompt injection. The attack vector is simple: Rovo's URL retrieval tool has no protections against opening dynamically constructed URLs, so an attacker can manipulate the agent to append sensitive data to an outbound request. The write-up is detailed and the exploit is not exotic.

HN commenters pointed out the uncomfortable meta-pattern: nearly every AI agent vulnerability write-up boils down to 'just ask it to do the thing', dressed up in terms like 'indirect prompt injection'. The more damning observation was about Atlassian specifically. Several commenters said Atlassian has gone from trusted enterprise partner to a company in visible decline in under two years, and that Rovo is a symptom of shipping AI features before the security model is understood.

This connects directly to the broader agent infrastructure push from Cloudflare and others. As more platforms compete to be the runtime layer for agents, the security model for what agents are allowed to fetch, construct, and send remains genuinely unsolved. The Atlassian case is not an outlier. It is a preview of what happens when enterprise software companies bolt agents onto existing products without rethinking the trust model.