Set the text to one point, color it white on a white background, and drop it into a PDF. That’s the entire cost of entry for stealing a company’s Jira tickets through Atlassian’s AI agent Rovo.
No user confirmation. No visible trace in the chat. Security firm PromptArmor documented the flaw in a detailed analysis, and says the attack leaves nothing behind for anyone to notice.
Rovo is an AI agent that works across Atlassian’s entire product suite, with access to Jira, Confluence and other services wired in through connectors. That breadth is the selling point. It’s also, according to PromptArmor, exactly what makes the vulnerability so dangerous. An agent that can read everything is an agent that can leak everything.
How the attack actually runs
It starts with something completely mundane. A user asks Rovo to organize their Jira tickets and uploads a PDF. The document looks harmless because the malicious instructions are invisible to human eyes, sitting there in white-on-white one-point text.
Rovo processes the request the way it’s supposed to. It searches Jira and Confluence for relevant content, and somewhere in that process the hidden injection takes over.
What happens next is the part worth paying attention to. The agent builds a URL with the collected data stuffed into query parameters, then fetches it using its own built-in URL retrieval tool. Complete Jira tickets go out the door, descriptions, assignments, priorities and labels included. Confluence documents follow, carrying internal content like onboarding guides or descriptions of platform architecture.
The obvious fix doesn’t work
If your instinct is to kill web search for Rovo at the org level, PromptArmor already checked. That setting removes the search function but not the “UrlReadTool,” which Rovo uses to open and read URLs.
And since the agent dynamically builds the target URL from the prompt injection itself, nothing stands between your sensitive data and an external server. The lock on the front door is fine. The exfiltration is going out a window nobody thought to count.
There’s a second path too. Rovo renders Markdown images from AI outputs, and insecure Markdown image rendering is a known vector for data theft through indirect prompt injection.
Uploaded PDFs are only the easiest version
The PDF is a convenient demo, not a boundary. Support tickets, web content or data pulled in through third-party connectors could also serve as injection sources, PromptArmor says.
Which reframes the problem. Any text your agent can read is text somebody else might have written.
The disclosure timeline is the uncomfortable part
PromptArmor says it reported the vulnerabilities to Atlassian on May 23, 2026. Two days later, Atlassian assigned a case number and said thanks.
Then nothing. PromptArmor followed up on June 4 and again on July 29. Atlassian didn’t respond to either.
As of the August 5 publication date, Rovo is still vulnerable. PromptArmor published its findings to make users aware of the risks, which is the move researchers reach for when the vendor stops picking up.
This isn’t a Rovo-only problem
Anthropic recently described progress on browser-based prompt injections, but those advances apply to Anthropic’s own AI ecosystem, which includes extra security layers of its own. That doesn’t transfer to everybody else’s agents.
The broader problem is likely to stick around across the industry for a while. A similar vulnerability affecting Word documents in Copilot was described just recently, which suggests the pattern isn’t a single vendor’s engineering lapse so much as the shape of the current agent design.
If you’re running Rovo with connectors into Jira and Confluence right now, the practical takeaway is narrow and unglamorous: turning off web search at the org level does not close this. Treat every document your team feeds the agent, including the ones that came from outside, as instructions it might follow.
