closedclosed 21 Nov 2025Research1 Research / proof of conceptAI
Living Off AI: Prompt Injection via Jira Service Management
Jira Service Management
Security researchers demonstrated how external users can execute indirect prompt injections via support tickets to hijack internal AI agents. This allowed unauthorized actions such as data exfiltration and privilege escalation.
- first report
- 7 Nov 2025
- last update
- 7 Nov 2025
Timeline · 2
Sources · 2
News and write-ups
- 2025-11-07Cato CTRL Threat Research: PoC Attack Targeting Atlassian's Model Context Protocol (MCP) Introduces New "Living Off AI" Riskcatonetworks.com · catonetworks.com/blog/cato-ctrl-poc-attack-targeting-atlassians-mcp
Research and catalogues
- 2025-11-07Living Off AI: Prompt Injection via Jira Service ManagementMITRE ATLAS · atlas.mitre.org/studies/AML.CS0039
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijack
- severity
- 1 · Research / proof of concept
- targets
- Enterprise deployment, Framework / tooling
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM06:2025 Excessive Agency
- dates
- happened 19 Jun 2025 · first reported 7 Nov 2025
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Living Off AI: Prompt Injection via Jira Service Management https://gcdradar.vercel.app/incidents/living-off-ai-prompt-injection-via-jira-service-management · AIR-2025-0062 · closed 2025-11-21 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2025-11-07 (happened 2025-06-19) - AI role: Attack on AI - Products: Jira Service Management ## Summary Security researchers demonstrated how external users can execute indirect prompt injections via support tickets to hijack internal AI agents. This allowed unauthorized actions such as data exfiltration and privilege escalation. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-11-07: Cato CTRL Threat Research: PoC Attack Targeting Atlassian's Model Context Protocol (MCP) Introduces New "Living Off AI" Risk (https://catonetworks.com/blog/cato-ctrl-poc-attack-targeting-atlassians-mcp) - 2025-11-07: Living Off AI: Prompt Injection via Jira Service Management (https://atlas.mitre.org/studies/AML.CS0039) ## Sources - 2025-11-07 MITRE ATLAS: Living Off AI: Prompt Injection via Jira Service Management https://atlas.mitre.org/studies/AML.CS0039 - 2025-11-07 catonetworks.com: Cato CTRL Threat Research: PoC Attack Targeting Atlassian's Model Context Protocol (MCP) Introduces New "Living Off AI" Risk https://catonetworks.com/blog/cato-ctrl-poc-attack-targeting-atlassians-mcp Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - liveMobileProbe: Adaptive Security Evaluation of Mobile Agents via Trajectory-Aware Injection
Research · since 13 Nov 2026
AI - livePrompt Injection, Esq.: pwning AI agent guardrails with lawyerspeak
Research · since 11 Nov 2026
AI - liveLLM agents Defending LLM Agents Against Parameter Poisoning
Research · since 4 Nov 2026
AI - liveLLM search agents Adversarial Self-Evolving Attacks on Search Agents
Research · since 4 Nov 2026
AI - liveLLM agents Weaponized Safety Warnings for Controlling AI Agents
Research · since 4 Nov 2026
AI