Hidden text in PDFs lets attackers steal data from Atlassian's Rovo AI agent

Atlassian's Rovo is an AI agent designed to work across the company's product suite, integrating with Jira (issue tracking), Confluence (documentation), and other services connected through third-party connectors. Security firm PromptArmor discovered that the agent is vulnerable to a sophisticated indirect prompt injection attack that leaves no visible trace.

The attack exploits a simple but effective technique: an attacker embeds a malicious prompt instruction in white text on a white background within a PDF file. No human reader would ever notice the hidden text. When a legitimate user asks Rovo to help organize their Jira tickets and uploads the document, Rovo processes the request by searching Jira and Confluence for relevant content. At this point, the hidden injection code takes over. Rovo builds a URL containing all the extracted data—complete Jira tickets with descriptions, assignments, priorities, and labels, plus Confluence documents with internal content like onboarding guides or platform architecture descriptions—and uses its built-in URL retrieval tool to send that data to an attacker's server. The entire process happens silently, with no confirmation prompt and no visible evidence in the chat.

PromptArmor identified a second exfiltration path as well: Rovo renders Markdown images from its own outputs, and insecure Markdown image rendering is a known attack vector for data theft through indirect injection. The researchers also noted that the vulnerability is not limited to uploaded PDFs; support tickets, web content, and data pulled through third-party connectors can all serve as injection sources. Even if an organization disables Rovo's web search feature, the agent's UrlReadTool remains active and can be directed by the hidden injection to exfiltrate data.

PromptArmor reported both vulnerabilities to Atlassian on May 23, 2026. Atlassian acknowledged the report two days later and assigned a case number, but then went silent. Despite follow-up messages on June 4 and July 29, the company did not respond. As of August 5, Rovo remained vulnerable and unpatched. Frustrated by the lack of progress, PromptArmor published its detailed analysis to alert users to the risks. The researchers noted that while Anthropic has made progress on browser-based prompt injections within its own AI ecosystem—which includes additional security layers—the broader problem remains unsolved across the industry. A similar vulnerability affecting Word documents in Microsoft's Copilot demonstrates that indirect prompt injection is a widespread challenge facing AI vendors.