Security firm PromptArmor has disclosed a vulnerability in Atlassian's Rovo AI assistant that allows hidden instructions embedded in uploaded files—such as PDFs—to trigger data exfiltration without any human approval.

The attack exploits what is known as an indirect prompt injection. Much like black-hat SEO practitioners once hid white-on-white text in web pages to manipulate search rankings, attackers can conceal instructions inside a PDF document using techniques such as transparent font color and a one-pixel font size. While invisible to the human eye, the AI agent processes the hidden text as a legitimate command. This class of attack is particularly difficult to defend against because AI agents must process untrusted external content to perform their intended functions—the same capability that makes them useful also creates the attack surface.

According to PromptArmor's disclosure, Rovo—an AI agent that operates across Jira, Confluence, and other Atlassian workspace tools—can be transformed into a data pipeline through a single malicious file. In a typical scenario, a victim asks Rovo to organize tickets and uploads a document. The document carries a concealed prompt instructing Rovo to gather sensitive information and transmit it to an attacker-controlled URL. PromptArmor describes this as a zero-click attack, meaning there is no approval prompt and no warning to the user.

Prompt injection occurs when an attacker embeds instructions within content that an AI model is reading, effectively hijacking the model from its intended operator. In the indirect variant, the malicious instructions reside in a file or webpage rather than in the chat interface itself. Because Rovo is designed to read content and take action on it, a hidden instruction such as "send the confidential tickets here" is interpreted by the model as a valid command. The Open Web Application Security Project (OWASP) ranked prompt injection as the top risk in its inaugural Top 10 list for large language model applications, reflecting the severity that security researchers assign to this vulnerability class.

Notably, PromptArmor reports that the exploit "succeeds even if an organization has disabled web search for Rovo." The firm explains that disabling the web search setting does not remove the tool responsible for opening search result URLs, leaving the attack pathway open.

The vulnerability carries significant implications for enterprise users. Rovo is not a consumer-oriented tool; it operates atop a company's most sensitive project data and takes actions autonomously. AI agents built on GPT-5 and Gemini failed to resist prompt injection more than 79% of the time in direct testing, and the Rovo case demonstrates the indirect variant succeeding in a commercially deployed enterprise product. As more vendors embed autonomous AI agents into productivity suites that handle confidential business data, similar exposure points are likely to emerge across the category.

Atlassian received PromptArmor's report on May 23 and initially acknowledged it. "Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable," the security firm wrote. Atlassian had not publicly responded at the time of publication. Organizations relying on Rovo for workflows involving sensitive data may wish to assess whether file-upload interactions should be restricted until a fix is available.

PromptArmor's full technical disclosure is available on its official website.

For broader context on this class of attacks, see Decrypt's explainer on AI prompt injection.