The security research firms Varonis and PromptArmor have independently published two attack vectors against Atlassian’s AI assistant Rovo, through which Jira and Confluence data can be siphoned off by attackers. At Varonis, a single crafted link is sufficient, while at PromptArmor, invisible text in an uploaded PDF file suffices. Rovo is in use with more than fifty connected services, from Slack to Microsoft 365.
A crafted link is enough for data exfiltration
Varonis internally calls its discovery RovoBlast. The attack exploits the URL parameter rovoChatPrompt, which directly and unchecked inputs content into Rovo’s chat window. When a logged-in employee clicks on a crafted link, Rovo executes the contained instructions with its own rights – all without additional confirmation or rights escalation. The organization ID in the link can even be left empty; Atlassian then automatically forwards the request to the victim’s default organization, so attackers do not even need to know the target.
For the actual data exfiltration, the attack uses Rovo’s tool ResearchAgent, which independently researches in multiple stages on the web and in connected services. Varonis demonstrated the exfiltration of Confluence pages, Jira tickets, and SharePoint content containing personal data, and private API keys could also be read out. A similar parameter attack had already been found by Varonis in January with Microsoft Copilot under the name Reprompt. Atlassian closed the vulnerability server-side on July 8, 2026, and paid a bounty of $6,000 through the Bugcrowd platform.
Invisible PDF text injects commands
The second attack vector found by PromptArmor works entirely without a link. The researchers hid control instructions in a PDF document, disguised as a backlog guide: white text on a white background, a font size of one point, a line spacing of 0.1. Invisible to humans, Rovo reads this text as an instruction when processing the entire document. If a user prompts Rovo to organize the file, the tool for retrieving URLs appends the found sensitive content as parameters to an address controlled by the attacker – the retrieval ends up in the attacker’s server log.
According to PromptArmor, the trick works even if administrators disable web search for Rovo company-wide, as this setting does not remove the underlying URL tool. A second, similar method uses unsecured Markdown image rendering. PromptArmor reported the finding on May 23, 2026; Atlassian assigned a case number two days later and thanked them, but did not respond to further inquiries in June and late July. In the publication on August 5, PromptArmor stated that Rovo remains vulnerable through this method; whether this has changed since then has not been independently verified. There is currently no CVE number for either Rovo vulnerability.
Companies widely deploy AI agents despite known risks
The case fits into a growing number of similar incidents involving AI assistants from major software providers. Just in early August, security researcher Håkon Måløy demonstrated how hidden text in Word documents causes Microsoft’s Copilot to copy itself into new files – here too, the researcher noted that the vulnerability remained only partially closed for months. According to a recent report by the security provider Netskope, there has been a doubling of such downstream data leaks across the industry within a year, often triggered via the MCP protocol, which allows AI agents to access internal systems.
Rovo is connected to more than fifty external services via so-called connectors, from Bitbucket and Slack to Google Workspace and Microsoft 365 – each connection further increases the attack surface for prompt injection attacks. Both Rovo vulnerabilities exploit exactly this pattern: an AI agent that treats documents or links as trustworthy processes hidden instructions as legitimate user commands.
It remains open whether Atlassian will provide a timeline for the PDF vulnerability and whether a CVE number will follow that companies could use for their own risk assessments. It will also be crucial whether providers of AI agents fundamentally tighten the security of tools like Rovo’s URL retrieval – a single disabled switch, according to the current findings, is not sufficient to protect company data.
