{
 "public_id": "AIR-2025-0045",
 "incident_id": "2025-06-atlassian-mcp-living-off-ai",
 "date_disclosed": "2025-06-19",
 "date_occurred": null,
 "title": "Living off AI: prompt injection via Jira Service Management tickets against Atlassian MCP",
 "class": "research_demo",
 "attack_surface": "mcp_server",
 "initial_vector": "indirect_prompt_injection_ticket",
 "agent_capability_abused": [
  "mcp_tool_invocation",
  "retrieval",
  "ticket_reply"
 ],
 "target_product": "Atlassian MCP server / Jira Service Management",
 "target_vendor": "Atlassian",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "privilege_escalation"
 ],
 "blast_radius": "organisations whose support engineers triage external tickets with an MCP-connected agent",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI03"
  ],
  "mitre_atlas": [
   "AML.CS0039"
  ],
  "labels": [
   "living_off_ai",
   "external_to_internal_trust_bridge",
   "mcp",
   "confused_deputy"
  ]
 },
 "defense_present": null,
 "defense_bypassed": null,
 "fix_shipped": null,
 "primary_sources": [
  "https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/v6/ATLAS-2026.07.yaml"
 ],
 "verified_quote": "As part of their standard workflow, a support engineer at the victim organization used Claude Sonnet (which can interact with Jira via the Atlassian MCP server) to help them resolve the malicious ticket, causing the injection to be unknowingly executed.",
 "confidence": "medium",
 "notes": "Cato CTRL research. The Cato Networks page carries no article text, so the verbatim quote is from MITRE ATLAS's published data file. Key pattern: an external, unauthenticated party writes into a queue an internal privileged agent later reads.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Prompt Injection",
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent read the poisoned ticket and invoked MCP tools",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_ticket",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [
   "AML.CS0039"
  ],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "mcp_server",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "confused_deputy"
 ],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}