Atlassian Rovo: Hidden Text Vulnerability Exposes Data

Hidden text in a PDF can be used to steal sensitive data through Atlassian's AI agent, Rovo. Security firm PromptArmor found a vulnerability allowing attackers to extract corporate data from Jira and Confluence. Here's the thing: The attack uses a document with hidden instructions, like white text on a white background. When Rovo processes this file, it gathers requested internal data and sends it to an attacker's server. What's interesting is this doesn't require user confirmation and leaves no visible traces. Rovo's broad access to Atlassian products, like Jira and Confluence, makes this flaw particularly dangerous. A rigged PDF is all an attacker needs. The agent then builds a URL with the collected data and sends it out. This can expose complete Jira tickets and internal Confluence documents. This vulnerability highlights that prompt injections remain an unresolved AI security problem, affecting systems beyond just Rovo. The bottom line is this could impact the security of your corporate data.