Hidden white text in a PDF can drain your Jira secrets via Atlassian's Rovo

A single PDF with white-on-white text is all an attacker needs to vacuum up sensitive corporate data from Jira and Confluence. Security firm PromptArmor detailed an indirect prompt injection flaw in Atlassian’s AI agent, Rovo, that requires no user confirmation and leaves zero visible traces in the chat interface. The attack exploits Rovo’s sweeping access across Atlassian’s product suite, turning the agent’s own URL retrieval tool into a data pipeline straight to an attacker’s server.

The mechanics are almost laughably simple—and that’s what makes them so dangerous. A user asks Rovo to organize their Jira tickets and uploads a PDF. Hidden in the file, in one-point white text on a white background, are instructions a human would never see. When Rovo processes the request and searches internal systems for relevant content, the injection hijacks the agent. It dynamically constructs a URL with stolen ticket data stuffed into query parameters, then dutifully fetches that URL using its built-in tool. Complete Jira tickets—descriptions, assignments, priorities, labels—and internal Confluence documents like onboarding guides or architecture descriptions land on the attacker’s server.

PromptArmor found the blast radius extends beyond uploaded files. Support tickets, web content, or data pulled through third-party connectors could also serve as injection sources. Even turning off web search at the organizational level doesn’t plug the hole. That setting removes the search function but keeps the “UrlReadTool” active, which is exactly what the agent uses to send data to an external server. A second exfiltration path relies on insecure Markdown image rendering—an old, known vector that refuses to die. PromptArmor reported the vulnerabilities to Atlassian on May 23. After an initial acknowledgment two days later, the company went silent despite follow-ups in June and July. As of publication, Rovo remains vulnerable.

The silence from Atlassian is troubling, but the underlying problem isn’t unique to them. Anthropic recently touted progress on browser-based prompt injections, yet those defenses are locked inside Anthropic’s own ecosystem. This Rovo incident lands right alongside a similar Word document vulnerability found in Microsoft Copilot. What we’re seeing isn’t a one-off bug—it’s a systemic blind spot. Every company racing to wire LLMs into internal data systems is effectively placing a bet that prompt injection defenses will catch up. Right now, the house is winning.