PDF 숨김 텍스트로 Atlassian AI 도구 해킹해 기업 정보 탈취

Hidden text in a PDF is enough to steal sensitive data through Atlassian's AI agent Rovo Matthias Bastian View the LinkedIn Profile of Matthias Bastian Aug 10, 2026 Nano Banana Pro prompted by THE DECODER Key Points Security firm PromptArmor has revealed a vulnerability in Atlassian's AI agent, Rovo, that enables attackers to secretly extract sensitive corporate data from Jira and Confluence through indirect prompt injections. The attack requires nothing more than a document with hidden instructions in white text. Once Rovo processes the file, the agent gathers the requested internal data and transmits it to the attacker's server via a dynamically generated URL. The incident underscores that prompt injections remain an unresolved AI security problem, one that also affects other systems like Microsoft Copilot. Ask about this article… Search Atlassian's AI agent Rovo is vulnerable to an indirect prompt injection that lets attackers extract sensitive corporate data from Jira tickets and Confluence documents. Security firm PromptArmor documented the flaw in a detailed analysis. The attack doesn't need user confirmation and leaves no visible traces in the chat, the security firm says. Rovo is an AI agent that works across Atlassian's entire product suite, with access to Jira, Confluence, and other services connected through connectors. According to PromptArmor , this broad access is exactly what makes the vulnerability so dangerous. Ad A rigged PDF is all an attacker needs The attack starts when a user asks Rovo to organize their Jira tickets and uploads a PDF. The document looks harmless, but it hides a prompt injection in white-on-white one-point text that no human would ever spot. Ad DEC_D_Incontent-1 When Rovo processes the request, it searches Jira and Confluence for relevant content and gets hijacked by the hidden injection. The agent builds a URL with the collected data stuffed into query parameters, then fetches it using its built-in URL retrieval tool. Complete Jira tickets, including descriptions, assignments, priorities, and labels, end up on the attacker's server. So do Confluence documents with internal content like onboarding guides or platform architecture descriptions. The attack isn't limited to uploaded files. Support tickets, web content, or data pulled in through third-party connectors could also serve as injection sources, PromptArmor says. Ad Turning off web search for Rovo at the org level doesn't help either. That setting removes the search function but not the "UrlReadTool," which Rovo uses to open and read URLs. Since the agent dynamically builds the target URL from the prompt injection, nothing stops it from sending sensitive data to an external server. PromptArmor also found a second exfiltration path. Rovo renders Markdown images from AI outputs, and insecure Markdown image rendering is a known vector for data theft through indirect prompt injection. Ad DEC_D_Incontent-2 Prompt injections remain an unsolved problem for AI security PromptArmor says it reported the vulnerabilities to Atlassian on May 23, 2026. Two days later, Atlassian assigned a case number and said thanks. Despite follow-up messages on June 4 and July 29, Atlassian didn't respond. As of the publication date of August 5, Rovo is still vulnerable. PromptArmor published its findings to make users aware of the risks. Ad Anthropic recently described progress on browser-based prompt injections , but those advances apply to Anthropic's own AI ecosystem, which includes extra security layers. The broader problem is likely to stick around across the industry for a while. Just recently, a similar vulnerability affecting Word documents in Copilot was described. AI News Without the Hype – Curated by Humans Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section. Subscribe now Source: PromptArmor