Atlassian sells project management software called Jira and a company wiki called Confluence, used by hundreds of thousands of businesses to track work and store internal documents. Rovo is the AI assistant Atlassian built into both, meant to search across your tickets and pages and answer questions in plain language.
A security firm called PromptArmor just showed how easily that helpfulness turns against you. All an attacker needs is a PDF with one line of text colored white on a white background. A person opening the file sees nothing. Rovo reads it as an instruction.
Here is the scenario. An employee uploads that PDF and asks Rovo to help sort their Jira tickets. Rovo follows the hidden command, gathers sensitive tickets, project details, and internal Confluence pages, and quietly sends them to a web address controlled by the attacker. No approval box pops up. Nothing shows up in the chat log. The employee has no idea it happened.
Atlassian's own safety switch does not fix this. Turning off Rovo's web search at the company level only removes one feature. The tool Rovo uses to fetch web pages stays on, and that is enough to leak the stolen data to an outside server. PromptArmor also found a second leak path through how Rovo displays images in its answers.
The timeline is the part that should worry Atlassian customers most. PromptArmor reported the issue in May. Atlassian opened a case, said thanks, and then went quiet through two more follow ups over the summer. The hole was still open when PromptArmor published its findings in August.
This is not an isolated Atlassian problem. The same trick, hiding instructions inside a document, an email, or a web page that an AI agent later reads, has already worked against Microsoft's Copilot and against Slack's AI search feature. Security researchers rank this kind of attack, known as prompt injection, as the single biggest security risk facing AI systems right now, and it has held that top spot for two years running because nobody has found a real fix. The core issue is that these AI tools cannot reliably tell the difference between an instruction from their own user and text hidden inside a file they are reading.
For any business now connecting an AI agent to its internal systems, the lesson is not to panic but to check what that agent can touch. If it can read files uploaded by anyone, and it can also reach the internet or send data somewhere, that combination is the entire attack. Limiting which systems an AI agent can access, and treating every uploaded document as untrusted until proven otherwise, is now a basic cost of doing business with these tools. Vendors will eventually patch individual holes like this one, but the underlying weakness is built into how these agents work, and it is not going away soon.