Shrink the font to a single point, paint it white on a white page, and tuck it inside a PDF. That is the whole price of admission for lifting a company’s Jira tickets by way of Rovo, Atlassian’s AI agent.
Nothing is confirmed by the user. Nothing shows up in the chat window. The flaw was documented by security firm PromptArmor in a detailed analysis, which notes that the attack leaves no residue for anyone to spot.
Rovo operates across the whole Atlassian product suite, reaching Jira, Confluence and other services through connectors. That reach is the pitch. In PromptArmor’s telling, it is also precisely what makes the hole so dangerous: an agent capable of reading everything is an agent capable of leaking everything.
How the attack actually runs
The opening move is thoroughly ordinary. Someone asks Rovo to tidy up their Jira tickets and attaches a PDF. The file appears benign, because the malicious instructions are white-on-white, one point tall, and invisible to the human eye.
Rovo then does its job as designed. It combs Jira and Confluence for relevant material, and at some point during that sweep the buried injection seizes control.
The next step is where the real damage lives. The agent assembles a URL, packs the harvested data into its query parameters, and then fetches that URL with its own built-in retrieval tool. Entire Jira tickets leave the building, descriptions, assignments, priorities and labels and all. Confluence documents go with them, carrying internal material such as onboarding guides or write-ups of platform architecture.
The obvious fix doesn’t work
Anyone whose first reaction is to switch off web search for Rovo across the org should know PromptArmor tested that already. The toggle strips out the search capability, but it leaves the “UrlReadTool” in place, which is what Rovo uses to open and read URLs.
Because the agent constructs the destination URL on the fly from the injected prompt itself, there is nothing sitting between sensitive data and an outside server. The front door is bolted. The data is climbing out a window nobody bothered to count.
A second route exists as well. Rovo renders Markdown images out of AI output, and insecure Markdown image rendering is an established channel for stealing data via indirect prompt injection.
Uploaded PDFs are only the easiest version
The PDF is a handy demonstration rather than a limit. According to PromptArmor, support tickets, web content or material arriving through third-party connectors could all act as injection sources just as well.
That recasts the whole issue. Whatever text your agent is able to read is text that someone else may have authored.
The disclosure timeline is the uncomfortable part
By PromptArmor’s account, the vulnerabilities went to Atlassian on May 23, 2026. Atlassian issued a case number two days later along with a thank you.
After that, silence. Follow-ups went out on June 4 and once more on July 29. Neither one drew a reply.
Rovo remained vulnerable as of the August 5 publication date. PromptArmor put the findings out to alert users to the risk, the step researchers fall back on once a vendor stops answering.
This isn’t a Rovo-only problem
Anthropic has lately outlined progress against browser-based prompt injections, but that work is confined to Anthropic’s own AI ecosystem, which layers on additional security of its own. None of that carries over to everyone else’s agents.
Across the industry, the underlying issue looks set to linger. A comparable weakness involving Word documents in Copilot surfaced only recently, hinting that this is less one vendor’s engineering slip than the shape of how agents are currently built.
For teams running Rovo with connectors into Jira and Confluence today, the practical lesson is narrow and distinctly unglamorous: disabling web search org-wide does not shut this down. Assume every document handed to the agent, especially anything originating outside the company, is a set of instructions it may well obey.