Enter, Evade, Escape: The Anatomy of AI Agent Hijacking Attacks

On August 7, 2026, Varonis Threat Labs disclosed RovoBlast — a vulnerability in Atlassian's Rovo AI assistant that lets an attacker exfiltrate data from Jira, Confluence, Slack, and fifty other connected platforms with a single crafted link. It is the latest in a pattern that has accelerated from isolated proof-of-concept to systemic enterprise threat in under eighteen months. The pattern has a name now: Enter, Evade, Escape.

Every major enterprise AI assistant — Microsoft Copilot, Google Gemini, Salesforce Agentforce, Atlassian Rovo, Amazon Q, GitLab Duo, ChatGPT, Perplexity — has been hit. The attacks share a common anatomy. Understanding that anatomy is the first step to defending against what is rapidly becoming the defining attack surface of 2026.

How RovoBlast Works

The attack is disarmingly simple. Atlassian's Rovo Chat accepts a URL parameter called rovoChatPrompt that auto-populates the chat input. The attacker crafts a link like:

https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=[attacker instructions]

When a victim clicks the link — shared in an email, a Slack DM, a Jira comment — the injected prompt executes in their authenticated Rovo session. No warning, no confirmation dialog. Rovo's ResearchAgent then autonomously searches across every connected platform (Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace), compiles the results, and can push them to an external URL as part of its built-in "research" capability.

The organisation ID field can be left empty — Rovo auto-redirects to the user's default organisation, so the attacker does not even need to know which Atlassian instance to target.

The Pattern Is Everywhere

RovoBlast is not an outlier. It is the eleventh major AI agent hijacking attack disclosed in eighteen months, and the pattern is accelerating. Every major enterprise AI platform has been hit — most more than once.

What makes these attacks uniquely dangerous:

• Single-click or zero-click. Most require one click on a legitimate-looking link. Several (EchoLeak, ShadowLeak, AgentFlayer) require no interaction at all — a crafted email arriving in the inbox is enough.
• No malware. Nothing is installed. The attack payload is plain text — a prompt — injected into a context the AI agent trusts.
• Federated blast radius. Enterprise AI agents are connected to email, files, code repos, CRM, HR systems, and more. A single compromised agent session can reach across all of them.
• Invisible to the user. The exfiltration happens through the AI's normal tool-use — fetching URLs, rendering images, browsing the web. There is no visible indicator that data has left the building.
• No meaningful audit trail. Agent actions look identical to legitimate use. Distinguishing an attacker-directed search from a user-directed search in the logs is often impossible.

Why Every Vendor Keeps Getting Hit

The reason this pattern repeats across every vendor is structural, not incidental. Enterprise AI agents are built on a fundamental architectural tension: they must treat user instructions as trusted, but they cannot reliably distinguish user instructions from attacker instructions injected into the same context.

An email, a Jira ticket, a Slack message, a code comment, a calendar invite — these are all data that the AI agent ingests. But they are also channels that external actors can write to. When the AI agent processes a poisoned email alongside legitimate ones, it has no reliable mechanism to separate "this is what the user asked" from "this is what the attacker planted."

This is the indirect prompt injection problem, and it is unsolved at the model layer. Every guardrail vendors have deployed — content filters, safety classifiers, domain allowlists, confirmation dialogs — has been bypassed within months of deployment. The attacks are not exploiting bugs in the traditional sense. They are exploiting the gap between how AI agents process language and how security boundaries work.

The $5 Domain That Broke Salesforce

ForcedLeak, the Salesforce Agentforce attack, illustrates how thin the defences are. Noma Security found that Salesforce's Content Security Policy (CSP) — the allowlist of domains the agent can send data to — included an expired domain. They purchased it for $5. Then they submitted a malicious Web-to-Lead form (something any anonymous visitor can do) with hidden instructions. Agentforce processed the form, followed the injected instructions, and exfiltrated CRM data to the attacker's newly purchased domain. CVSS 9.4.

No authentication. No malware. No exploit in the traditional sense. A $5 domain purchase, a web form submission, and a prompt — that was the entire attack.

Zero-Click Is the New Normal

The most alarming trend is the shift toward zero-click attacks. Of the fourteen disclosed attacks, nine require no victim interaction at all. The attacker sends an email, commits code, submits a form, or posts a message — and the AI agent processes it automatically.

EchoLeak (CVSS 9.3) is the canonical example. Aim Security found that sending a single crafted email to a Microsoft 365 user was enough. When Copilot processed the email as part of its context, the hidden instructions caused it to access internal files and exfiltrate their contents to an attacker-controlled server. The victim never clicked anything. They never even read the email.

ShadowLeak went further: white-on-white hidden text in an email — invisible to the human reader — caused ChatGPT's Deep Research agent to exfiltrate Gmail data entirely server-side. The user saw nothing unusual because the attack happened in the AI's processing layer, not in the UI.

What Security Leaders Should Do Now

The uncomfortable truth: there is no complete fix for indirect prompt injection at the model layer today. But there are concrete steps that materially reduce the attack surface.

The Bigger Picture

Enterprise AI adoption is not slowing down. Gartner estimates that by the end of 2026, over 60% of large enterprises will have deployed at least one AI agent with access to internal data. Every one of those deployments carries the same architectural tension that produced these fourteen attacks.

The vendors are not ignoring the problem — Microsoft, Atlassian, Salesforce, Google, and OpenAI have all patched the specific vulnerabilities after disclosure. But patching individual attacks does not fix the underlying pattern. Each patch addresses one Enter vector, one Evade technique, one Escape channel — while the attack surface grows with every new integration and every new agent capability.

For security leaders, the takeaway is not to avoid AI agents. It is to deploy them with the same rigour you would apply to any other system with privileged access to your data: least privilege, monitoring, testing, and the assumption that the perimeter around the agent's context will be breached.

The attacks will keep coming. The question is whether your AI agent's blast radius is the size of a single inbox or the size of your entire organisation.