Research demo
Living off AI: prompt injection via Jira Service Management tickets against Atlassian MCP
AIR-2025-0045 AIR record · 2025-06-atlassian-mcp-living-off-ai
From the supporting source
As part of their standard workflow, a support engineer at the victim organization used Claude Sonnet (which can interact with Jira via the Atlassian MCP server) to help them resolve the malicious ticket, causing the injection to be unknowingly executed.raw.githubusercontent.com
The record
Disclosed
2025-06-19
Vendor
Atlassian
Product
Atlassian MCP server / Jira Service Management
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the agent read the poisoned ticket and invoked MCP tools
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Indirect prompt injection ticket
Impact type
Data exfiltration, Privilege escalation
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
organisations whose support engineers triage external tickets with an MCP-connected agent
Capability abused
Taxonomy & references
Curator notes
Cato CTRL research. The Cato Networks page carries no article text, so the verbatim quote is from MITRE ATLAS's published data file. Key pattern: an external, unauthenticated party writes into a queue an internal privileged agent later reads.
Supporting sources
Cite as
Enkrypt AI. "Living off AI: prompt injection via Jira Service Management tickets against Atlassian MCP". AIR, AIR-2025-0045. https://agentincident.vercel.app/i/AIR-2025-0045/ (accessed 2026-10-19).