Security firm PromptArmor has disclosed a serious vulnerability in Atlassian's AI agent Rovo that lets attackers steal sensitive corporate data from Jira tickets and Confluence documents. The attack works through indirect prompt injection, using a PDF with hidden white-on-white text. No user confirmation is needed, and the breach leaves no visible traces in the chat.
How the Attack Works
Rovo is an AI agent that operates across Atlassian's entire product suite. It has access to Jira, Confluence, and other services connected through connectors. That broad access makes the vulnerability especially dangerous.
The attack begins when a user asks Rovo to organize Jira tickets and uploads a PDF. The PDF contains a hidden prompt injection written in white-on-white one-point text. When Rovo processes the request, it searches Jira and Confluence for relevant content. The hidden injection then hijacks Rovo's processing.
Rovo builds a URL with collected data placed in query parameters. It fetches that URL using its built-in URL retrieval tool. Complete Jira tickets, including descriptions, assignments, priorities, and labels, are sent to the attacker's server. Confluence documents, such as onboarding guides and platform architecture descriptions, are also exfiltrated.
The attack can also originate from support tickets, web content, or third-party connectors. It requires nothing more than a document with hidden instructions in white text.
Disabling Web Search Does Not Help
Organizations might think turning off web search for Rovo at the org level would stop the attack. It does not. Disabling web search removes the search function but leaves the "UrlReadTool" active. Rovo dynamically builds the target URL from the prompt injection, allowing data exfiltration to continue.
There is a second exfiltration path as well. Rovo renders Markdown images from AI outputs. Insecure Markdown image rendering is a known vector for data theft via indirect prompt injection.
Atlassian Did Not Respond
PromptArmor reported the vulnerability to Atlassian on May 23, 2026. Two days later, on May 25, 2026, Atlassian assigned a case number and thanked PromptArmor. Then the silence began.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
PromptArmor followed up on June 4, 2026, and again on July 29, 2026. Atlassian did not respond either time. As of the publication date of PromptArmor's findings, August 5, 2026, Rovo was still vulnerable.
PromptArmor published its findings to make users aware of the risks. The Decoder's Matthias Bastian wrote the article covering the disclosure, published on Aug 10, 2026.
A Broader Industry Problem
Prompt injections remain an unresolved AI security problem. The broader issue is likely to stick around across the industry for a while. Anthropic recently described progress on browser-based prompt injections, but only for its own ecosystem. That progress does not generalize.
A similar vulnerability affecting Word documents in CoPilot directory was recently described. This pattern suggests a systemic issue, not an isolated flaw in one product.
The attack is stealthy because it leaves no visible traces in the chat. Users have no way to know their data has been stolen. The broad access of Rovo makes the vulnerability especially dangerous, and the lack of response from Atlassian leaves customers exposed.
What Users Should Know
Anyone using Rovo with Jira or Confluence should treat uploaded PDFs with caution. Hidden text in documents can carry malicious instructions that the AI will follow silently. The attack requires no user confirmation and leaves no visible traces in the chat.
The vulnerability remains unfixed due to the lack of response from Atlassian. PromptArmor's disclosure is meant to raise awareness, not to pressure a fix that has not come. As of the publication date, Rovo is still vulnerable.
The article includes an image from PromptArmor showing the hidden text in a PDF. That image illustrates how invisible the attack can be to human eyes.