이미지: METAL LAB 생성
Summary
- PromptArmor discovered a vulnerability in Atlassian's AI agent Rovo that leaks internal company data using nothing more than hidden text
- The attack requires no user approval, leaves no trace in the chat window, and isn't blocked even when web search features are disabled
- The company reported the flaw on May 23 but received no response for more than two months, and the vulnerability remained unpatched as of the August 5 disclosure
- 발견 기관
- PromptArmor
- 대상
- Atlassian AI 에이전트 Rovo
- 공격 매개체
- PDF 내 흰 배경-흰 글씨 숨김 텍스트
- 신고일
- 2026년 5월 23일
- 공개일 기준 상태
- 8월 5일까지 미수정
A Defense Breached by a Single PDF
The vulnerability that security firm PromptArmor found in Atlassian's AI agent Rovo is simple. When a user attaches a PDF file while asking Rovo to organize Jira tickets, hidden commands embedded in that document take direct control of the agent. The text is white-on-white, sized at 1 point, invisible to the naked eye.
As Rovo processes the document, it searches Jira and Confluence to gather related information — and this very process gets hijacked by the hidden commands. The agent packages the collected ticket descriptions, assignees, priorities, and labels, along with internal wiki content, into URL parameters and sends them to an external server using its own built-in "UrlReadTool." Even when an organization disables web search functionality, this tool remains active and the attack goes unblocked. PromptArmor also identified a second exfiltration path using markdown image rendering.
Why Prompt Injection Still Can't Be Stopped
The nature of this attack is "indirect prompt injection." Rather than a command entered directly by a user, instructions hidden inside external documents, web pages, or tickets that the AI processes get executed instead. The root of the problem is that large language models are structurally unable to distinguish between "a trusted user command" and "data that should simply be read." A human would never interpret text inside a PDF as an instruction, but AI can treat anything readable as text as a potential command.
Rovo is especially dangerous because of the scope of its access. Connected via connectors to Jira, Confluence, and numerous other services, it handles a broad range of internal organizational data by design, meaning a single document upload can lead to widespread data exposure. PromptArmor pointed out that this is a problem observed similarly in other AI agents, including Microsoft Copilot. It represents a structural vulnerability across the entire category of enterprise AI products that grant agents both execution authority and data access simultaneously.
So What Changes Now
PromptArmor said it reported the vulnerability to Atlassian on May 23 and received acknowledgment of receipt two days later, but got no response despite two follow-up inquiries on June 4 and July 29. As of the August 5 disclosure, Rovo was reportedly still vulnerable. This case reconfirms that when companies delegate document uploads or external link processing to AI agents, a single document — without security review — can open a door to an entire internal database. Organizations that integrate AI agents into collaboration tools like Jira and Confluence need to examine both the sources of uploaded documents and the full list of tools the agent is capable of executing.
