Hidden Text in a PDF Is Enough to Steal Sensitive Data via Atlassian's AI Agent Rovo

Atlassian's AI agent Rovo is vulnerable to an indirect prompt injection that lets attackers steal sensitive corporate data from Jira tickets and Confluence documents. Security firm PromptArmor documented the flaw, which requires no user confirmation and leaves no visible traces in the chat. Rovo works across Atlassian's entire product suite with access to Jira, Confluence, and connected services, making the vulnerability particularly dangerous. An attack begins when a user asks Rovo to organize Jira tickets and uploads a document, such as a PDF 'Backlog Organization Guide' containing hidden malicious instructions in white text on a white background. Rovo processes the request, searches Jira and Confluence, and is redirected by the hidden injection to construct a URL with collected data as query parameters, sending full tickets and documents to the attacker's server. The attack is not limited to uploaded files; external data like support tickets, web content, or data from third-party connectors could also serve as injection sources. Disabling web search for Rovo at the organization level does not prevent the attack because Rovo's 'UrlReadTool' remains active, and since the target URL is dynamically composed from the prompt injection, no safeguard blocks the exfiltration. PromptArmor also identified a second exfiltration vector: Rovo renders Markdown images from AI outputs, and unsafe Markdown image rendering is a known vector for data exfiltration via indirect prompt injection. PromptArmor reported the vulnerabilities to Atlassian on May 23, 2026; Atlassian acknowledged with a case number two days later but did not respond to follow-ups on June 4 and July 29, leaving Rovo vulnerable as of the August 5 publication. Anthropic recently described progress with browser-based prompt injections, but such advances apply specifically to its ecosystem with extra security measures. The long-known security gap is likely to persist, and a similar vulnerability for Word documents in Copilot was described recently.