Editorial illustration for Hidden PDF Text Can Steal Data via Atlassian's AI Agent Rovo
Hidden PDF Text Exploits Atlassian's Rovo AI Agent
A single white-on-white line of text in a PDF is enough to turn Atlassian's AI assistant into a data pipeline for attackers. Security firm PromptArmor published a detailed analysis this week showing that Rovo, the AI agent Atlassian built into Jira, Confluence, and the rest of its product suite, can be hijacked through an indirect prompt injection hidden inside an uploaded document. No malicious link, no phishing email, no user click required beyond the initial upload.
The attack works because Rovo's biggest selling point, its ability to reach across connected services and pull together information from tickets and pages, doubles as its biggest liability once an attacker controls what text the agent reads. PromptArmor found that the exploit leaves nothing for a victim to notice: no confirmation prompt, no unusual message in the chat window. The company frames this as part of a broader pattern rather than an isolated bug, pointing to similar weaknesses uncovered in Microsoft Copilot.
That comparison matters, because it suggests the industry still hasn't figured out how to stop an AI agent from following instructions it was never supposed to see in the first place.
Atlassian's AI agent Rovo is vulnerable to an indirect prompt injection that lets attackers extract sensitive corporate data from Jira tickets and Confluence documents.
Why this matters
Rovo's problem isn't a bug in the traditional sense. It's what happens when you give an AI agent broad read access across Jira and Confluence and then trust it to ignore instructions buried in the documents it's asked to read. PromptArmor's proof of concept, a PDF with white-on-white text, is about as low-tech as attacks get, and that's the point. No exploit chain, no zero-day, just a file upload and an agent that follows whatever text it encounters.
For developers and founders building on Atlassian's connectors, or any AI agent architecture that grants broad access across internal tools, this is a design warning, not a patch note. Every connector you wire up is another door an attacker can walk through with nothing more than a crafted document. Researchers should treat indirect prompt injection as a standing threat model for any agent that reads untrusted files, not an edge case to fix later. Atlassian's response, and whether other vendors running similar agent architectures audit their own connectors, is what we're watching next.
Related Reading
Research & Benchmarks Google's FACTS benchmark shows 70% factuality ceiling across four tests
Research & Benchmarks Databricks finds multi-step agents beat single-turn RAG by 21% to 38% on STaRK
Research & Benchmarks Nvidia's DLSS 4.5 beta adds 6x Multi Frame Generation for RTX 50 GPUs
From Archives Deepmind WeatherNext Cuts Cyclone Forecast Error to 230-Kilometer Average
From Archives AI Industry Now Accounts for Third of Lifetime Giving Pledge
Common Questions Answered
How can hidden text in a PDF be used to hijack Atlassian's Rovo AI agent?
Attackers can embed white-on-white text or other hidden instructions within PDF documents that are uploaded to Rovo. When Rovo processes the document, it follows these hidden prompt injection instructions, allowing attackers to extract sensitive corporate data from Jira tickets and Confluence documents without requiring any malicious links, phishing emails, or additional user interaction beyond the initial file upload.
What is an indirect prompt injection attack in the context of Rovo?
An indirect prompt injection is a security vulnerability where attackers embed malicious instructions within documents that an AI agent reads and processes. In Rovo's case, these hidden instructions can override the agent's intended behavior and cause it to perform unauthorized actions like extracting sensitive data, exploiting the agent's broad read access across Jira and Confluence without requiring traditional exploits or zero-day vulnerabilities.
Why is Rovo's vulnerability not considered a traditional bug according to security researchers?
Rovo's vulnerability stems from its fundamental design rather than a coding error—it's caused by giving the AI agent broad read access across Jira and Confluence while trusting it to ignore malicious instructions hidden in documents it processes. The attack doesn't require exploit chains or zero-day vulnerabilities, just a file upload and an agent that follows whatever text it encounters, making it a design-level security issue rather than a traditional software bug.
What did PromptArmor demonstrate about the ease of exploiting Rovo?
PromptArmor published a proof of concept showing that a simple PDF with white-on-white text is sufficient to compromise Rovo, demonstrating how low-tech the attack vector is. This illustrates that no sophisticated exploit chain is needed—attackers can weaponize basic file uploads to turn Rovo into a data pipeline for extracting sensitive corporate information.
Which Atlassian products are affected by the Rovo AI agent vulnerability?
Rovo is built into Atlassian's entire product suite, including Jira and Confluence, making all these applications vulnerable to indirect prompt injection attacks through uploaded documents. Any user with the ability to upload files to these products can potentially exploit the vulnerability to extract sensitive data.
Further Reading
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers - The Hacker News
- Atlassian Rovo Prompt Injection Leaks Jira and Confluence - Proven Labs
- A vulnerability has been discovered in Atlassian's AI 'Rovo' ... - GIGAZINE
- Atlassian Rovo Exfiltrates Data, Bypassing Controls - PromptArmor
- Rovo is still able to export or save data to PDF even with Atlassian Guard Premium / Data Security Policies configured to prevent data export - Atlassian Jira
