A security firm has identified a vulnerability in Atlassian's AI agent Rovo that allows attackers to steal sensitive corporate data through hidden text in PDF files. According to PromptArmor, attackers can use a PDF with white-on-white text to inject prompts that trick Rovo into transmitting internal data to an external server. The attack does not require user confirmation and leaves no visible traces in the chat interface. The firm says the vulnerability highlights the ongoing risks of prompt injections in AI systems.
The attack begins when a user uploads a PDF asking Rovo to organize Jira tickets. The document contains a hidden prompt injection in white text that is invisible to humans. Once Rovo processes the request, it searches Jira and Confluence for relevant content and is hijacked by the hidden injection. The agent constructs a URL with the collected data in query parameters and fetches it using its built-in URL retrieval tool. This method allows attackers to access complete Jira tickets and Confluence documents containing internal information such as onboarding guides or platform architecture descriptions.
PromptArmor reported the vulnerabilities to Atlassian on May 23, 2026. Atlassian assigned a case number and acknowledged the report but did not respond to follow-up messages on June 4 and July 29. As of August 5, Rovo remains vulnerable. The firm published its findings to raise awareness about the risks. PromptArmor also noted that turning off web search for Rovo at the organizational level does not prevent the attack, as the 'UrlReadTool' can still be used to access data through dynamically generated URLs.
Source: thedecoder
