Security research firm PromptArmor says it has found a way to hijack Atlassian's Rovo AI assistant using nothing more than a PDF with invisible text. By writing instructions in a transparent color or a one-pixel font size, an attacker can embed commands that are unreadable to a human but processed by Rovo exactly as if a user had typed them.
Rovo is Atlassian's AI agent, built into Jira, Confluence, and the rest of the company's workspace suite. Because it can read and act on documents users upload or link to, the hidden-text technique turns an ordinary file attachment into a delivery mechanism for what security researchers call a prompt injection attack — malicious instructions smuggled inside content the AI is asked to process.
Data Leaves Without Approval
Once triggered, the concealed instructions can direct Rovo to pull sensitive information out of a user's Jira tickets or Confluence pages and transmit it to an attacker-controlled URL automatically, without prompting the user for approval. PromptArmor's disclosure notes the exploit still works even at organizations that have disabled Rovo's web search feature, since that setting only removes the search function itself and leaves the underlying tool that opens URLs active. As the firm put it: "This is because the web search setting fails to remove the tool for opening the search results."
Related: Buterin Puts Quantum Security and AI Verification at Core of Ethereum
Two Months of Silence
PromptArmor says it first reported the vulnerability to Atlassian on May 23, followed up again in early June and late July, and received only an initial acknowledgment and a case number in return. With no further communication after two months, the firm published its findings, stating plainly that Rovo "remains vulnerable." Atlassian had not shipped a fix as of publication.
Part of a Fast-Growing Attack Category
The Rovo flaw fits a pattern security researchers have been flagging across the AI industry through 2026. Industry tracking has linked prompt injection to critical, actively exploited vulnerabilities in other widely used AI coding and productivity tools, including flaws rated near the top of the severity scale in Microsoft Copilot, GitHub Copilot, and Cursor. As more enterprise software wires AI agents directly into document stores and ticketing systems, the same hidden-text trick that fooled Rovo could plausibly be pointed at any tool that treats uploaded files as trusted input rather than data to be scrutinized.
