# Atlassian AI 智能体 Rovo 存在间接提示词注入漏洞，可窃取 Jira 与 Confluence 敏感数据

- 来源：The Decoder：AI News（RSS）
- 作者：Matthias Bastian
- 发布时间：2026-08-10 16:46
- AIHOT 分数：66
- AIHOT 链接：https://aihot.virxact.com/items/cmsn0p12f03umrognrx8kgn6u
- 原文链接：https://the-decoder.com/hidden-text-in-a-pdf-is-enough-to-steal-sensitive-data-through-atlassians-ai-agent-rovo

## AI 摘要

安全公司 PromptArmor 披露，Atlassian 的 AI 智能体 Rovo 存在间接提示词注入漏洞，攻击者仅需上传一个隐藏白色文字指令的 PDF，即可在无需用户确认且不留痕迹的情况下，窃取 Jira 工单和 Confluence 文档中的敏感数据。

## 正文

Key Points

Security firm PromptArmor has revealed a vulnerability in Atlassian's AI agent, Rovo, that enables attackers to secretly extract sensitive corporate data from Jira and Confluence through indirect prompt injections.

The attack requires nothing more than a document with hidden instructions in white text. Once Rovo processes the file, the agent gathers the requested internal data and transmits it to the attacker's server via a dynamically generated URL.

The incident underscores that prompt injections remain an unresolved AI security problem, one that also affects other systems like Microsoft Copilot.

Atlassian's AI agent Rovo is vulnerable to an indirect prompt injection that lets attackers extract sensitive corporate data from Jira tickets and Confluence documents.

Security firm PromptArmor documented the flaw in a detailed analysis. The attack doesn't need user confirmation and leaves no visible traces in the chat, the security firm says.

Rovo is an AI agent that works across Atlassian's entire product suite, with access to Jira, Confluence, and other services connected through connectors. According to PromptArmor, this broad access is exactly what makes the vulnerability so dangerous.

A rigged PDF is all an attacker needs

The attack starts when a user asks Rovo to organize their Jira tickets and uploads a PDF. The document looks harmless, but it hides a prompt injection in white-on-white one-point text that no human would ever spot.

The document the user uploads contains a hidden prompt injection in white text on a white background. | Image: PromptArmor

When Rovo processes the request, it searches Jira and Confluence for relevant content and gets hijacked by the hidden injection. The agent builds a URL with the collected data stuffed into query parameters, then fetches it using its built-in URL retrieval tool. Complete Jira tickets, including descriptions, assignments, priorities, and labels, end up on the attacker's server. So do Confluence documents with internal content like onboarding guides or platform architecture descriptions.

The attack isn't limited to uploaded files. Support tickets, web content, or data pulled in through third-party connectors could also serve as injection sources, PromptArmor says.

Turning off web search for Rovo at the org level doesn't help either. That setting removes the search function but not the "UrlReadTool," which Rovo uses to open and read URLs. Since the agent dynamically builds the target URL from the prompt injection, nothing stops it from sending sensitive data to an external server.

PromptArmor also found a second exfiltration path. Rovo renders Markdown images from AI outputs, and insecure Markdown image rendering is a known vector for data theft through indirect prompt injection.

Prompt injections remain an unsolved problem for AI security

PromptArmor says it reported the vulnerabilities to Atlassian on May 23, 2026. Two days later, Atlassian assigned a case number and said thanks. Despite follow-up messages on June 4 and July 29, Atlassian didn't respond. As of the publication date of August 5, Rovo is still vulnerable. PromptArmor published its findings to make users aware of the risks.

Anthropic recently described progress on browser-based prompt injections, but those advances apply to Anthropic's own AI ecosystem, which includes extra security layers. The broader problem is likely to stick around across the industry for a while. Just recently, a similar vulnerability affecting Word documents in Copilot was described.

PromptArmor