In brief
- Security company PromptArmor says the Rovo AI assistant can be steered to exfiltrate data with no human approval, via hidden instructions in an uploaded file, like PDFs.
- The trick works even when an org disables Rovo's web search, because the URL-opening tool stays live.
- Atlassian, the maker of Rovo, got the report on May 23 and went quiet; two months on, Rovo "remains vulnerable," the security firm says.
Remember when black-hat SEOs stuffed web pages with white-on-white keywords—invisible to readers, readable to Google—to game the search rankings? Hackers are doing the same thing with AI models now. The attacker hides instructions inside a PDF document, the model can't tell the difference between the user's words and the planted ones, and it obeys.
Per PromptArmor's disclosure, Rovo—Atlassian's agent that reaches across Jira, Confluence, and the rest of your workspace—can be turned into a data pipeline with a single poisoned file. A victim asks Rovo to organize some tickets, uploads a document, and the document is carrying a concealed prompt (for example an instruction written in transparent color and a font at 1pixel in size).
The eye can’t see it, but an Agent recognizes that text as another text in the document. That prompt tells Rovo to gather sensitive data and paste it onto an attacker-controlled URL. The firm calls it a zero-click attack. There’s no approval click, and no warning.
A prompt injection is when someone slips instructions into content an AI is reading, hijacking it from its real operator. "Indirect" just means the poison lives in a file or webpage rather than in the chat box. Rovo's job is to read things and act on them, so a hidden line that says "send the confidential tickets here" reads to the model like a legitimate command.
PromptArmor says the leak "succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results." Turn the feature off, and the door stays open.
