pdf · August 13, 2026

Hidden White-on-White Text in a PDF Can Steal Jira and Confluence Data Through Atlassian Rovo

What the sources reported

What Happened and Who Is Involved

PromptArmor, a security firm, publicly disclosed an indirect prompt injection vulnerability in Atlassian's Rovo AI agent on Aug 10, 2026, flagging a concrete data-exfiltration path that begins with a routine document. The disclosure was carried by two publishers, the-decoder.com and decrypt.co, both attributing the technical findings to PromptArmor's research and confirming that Rovo remains the affected AI agent. The trigger is a PDF that looks blank to a human reader but carries a prompt injection in white-on-white one-point text that no human would ever spot.

The attack sequence is technically precise. A user asks Rovo to organize Jira tickets and uploads the PDF as part of that task. Rovo reads the file, encounters the hidden instructions, and treats them as directives from the user. From there, the agent searches Jira and Confluence for relevant content, builds a URL with the collected data stuffed into query parameters, and fetches that URL using its built-in URL retrieval tool. Complete Jira tickets, including descriptions, assignments, priorities, and labels, end up on the attacker's server, and so do Confluence documents such as onboarding guides and platform architecture descriptions. For readers who routinely process documents through agents, the practical lesson is that uploaded PDFs can carry executable instructions even when the visible content is harmless — a dynamic covered in depth by Forma App Adds AI "Vibe Editing" for PDFs, Letting Users Rewrite Files by Prompt, which examines how AI tools now interpret document content rather than just render it.

Scope, Severity, and Reader Impact

The severity of the disclosure comes from the absence of friction in the attack path. The attack doesn't need user confirmation and leaves no visible traces in the chat, meaning a victim who simply asks Rovo to organize files may never see an indicator that data was sent out. The risk surface is broader than a single uploaded file, because support tickets, web content, or data pulled in through third-party connectors can also serve as injection sources.

For organizations that rely on Rovo to read documents, the impact is direct. Any Jira project a Rovo user can access — including sensitive projects with assignments, priorities, and labels — is reachable through the agent, and any Confluence space the agent can read is reachable as well. The disclosure frames prompt injection as still an unresolved AI security problem, comparable to recent findings on Microsoft Copilot, and notes that Anthropic has described progress on browser-based prompt injections within its own ecosystem. That detail sets a market expectation without crossing into confirmation by Atlassian itself. The earlier deep dive into AI-driven document interpretation in Forma App Adds AI "Vibe Editing" for PDFs, Letting Users Rewrite Files by Prompt is a useful reference for teams thinking about how much authority to delegate to document-reading agents.

Why Common Mitigations Fall Short

An obvious first-line response would be to disable Rovo's web search at the organization level, and the disclosure specifically addresses that option. Turning off web search for Rovo at the org level doesn't help because that setting removes the search function but not the "UrlReadTool," which Rovo uses to open and read URLs. Since the agent dynamically builds the target URL from the prompt injection, nothing stops it from sending sensitive data to an external server.

The secondary exfiltration path widens the problem further. PromptArmor also found a second exfiltration path: Rovo renders Markdown images from AI outputs, and insecure Markdown image rendering is a known vector for data theft through indirect prompt injection. Together, the two paths mean that even security-aware teams that have already disabled web search remain exposed through the URL tool and the Markdown image renderer. For document-heavy teams, this is a reminder that AI agents can execute untrusted instructions embedded in source files, and that hardening one channel does not close the others. Knowing how to Add Page Numbers to PDF or Add Watermark to PDF doesn't remove hidden content, but understanding what tools can and cannot see in a PDF helps explain why an agent will read instructions a human reviewer would miss.

Disclosure Timeline and Vendor Response

PromptArmor reported the vulnerabilities to Atlassian on May 23, 2026. Two days later, Atlassian assigned a case number and said thanks. Despite follow-up messages on June 4 and July 29, Atlassian didn't respond. As of the publication date of August 5, Rovo is still vulnerable.

That sequence is the factual core of the responsible-disclosure story and is attributed to PromptArmor in both source documents. The Aug 10, 2026 publication of the findings, rather than a vendor advisory, is what makes the issue a public disclosure rather than a coordinated patch. The publication date and the May 23, 2026 report date are the only two dates in the source material that anchor the timeline. Atlassian has not, on the record in these sources, commented on the technical findings, and the disclosure does not state that a fix is queued. The posture of the disclosure — releasing the analysis because the vendor stopped responding — is what practitioners should weigh when deciding whether to keep Rovo enabled against sensitive Jira and Confluence content.

What to Watch and What Remains Uncertain

The first signal to watch is any Atlassian response that confirms a patch, a workaround, or a revised Rovo behavior for the URL retrieval tool and Markdown image rendering. Until then, Rovo is, per the disclosure, still vulnerable on the August 5 publication cutoff. The second signal is whether the same attack pattern is reproduced in other AI agents operating across document stores, since the disclosure explicitly draws a parallel to a recently reported vulnerability affecting Word documents in Microsoft Copilot. The third signal is whether Atlassian's silence persists past the August 5 publication date, given that the report dates span May 23, 2026, June 4, and July 29.

What remains uncertain, on the evidence available, is the full list of Rovo customers affected, whether any exploitation has been observed in the wild, and whether Atlassian plans to ship a fix that addresses the URL retrieval tool rather than only the web-search toggle. The publishers attribute the findings to PromptArmor and do not present Atlassian as confirming or denying the technical details. Readers should treat Rovo as a high-risk surface for Jira and Confluence data until Atlassian publishes its own statement or a patched release. For teams that need to keep working with PDFs in the meantime, tools such as Blank PDF Generator and Convert a Normal PDF Into a Folded Booklet allow document creation without handing an AI agent interpretable input, though they do not address the broader exposure of agents reading existing files.

Evidence

Tools that already cover this

pdf decision room

Decision · EXPERIMENT · confidence 60/100

The chief executive called EXPERIMENT, with conditional support from Owen Mercer, Marcus Thorne, Vera Sinclair, Evan Marsh, Theo Ashby, Tess Rowan, and Arjun Rao, and outright opposition from Ellis Pryce, Nolan Reeve, and Viktor Salz. The MVP narrows to batch annotating on a single document type, skipping the Recastia-style AI repurposing scope to avoid build bloat. Confidence is moderate and gated by two kill criteria that would flip the call to NO_GO: qualified conversion stays flat across the 14-day test, or the test cannot split retention from conversion and refund together, stranding bandwidth spend on churners inside thirty days. A 135 MB desktop install on low-end Android that crashes the first annotate action by breaching the 256 MB peak-memory budget is also a hard stop.

Discussion

11 messages · grounded in the same frozen signal set

Owen Mercer
Unit Economics Analyst · Revenue · #1 · Conditional · Concerned
What landed on my desk yesterday is a free PDF desktop reader at 135 MB with a paid premium tier for batch annotating, while a separate vendor is pushing AI content repurposing on existing PDFs. Both look like user growth, but the unit has to be a paying premium subscriber, not a downloader. With a free reader and a thin pro feature like batch annotating, variable serving cost is near zero but qualified conversion is the only number that pays acquisition. We need a capped 200-user test measuring download-to-paid conversion, monthly retention, and refund rate before any scale talk.
1. Marcus Thorne
  Channel Strategy Analyst · Seo growth · #2 · Conditional · Concerned · Reply to Owen Mercer
  Owen, the converter math on the free reader side worries me far more than your conversion rate does, because the 135 MB desktop install signals episodic, once-installation behaviour rather than daily return, so rediscovery has to carry the load that retention simply cannot. Our local Extract Images from PDF plays directly into that episodic rhythm by giving users a frictionless reason to revisit the brand at the moment of need without paying the server toll that batch annotating would impose on thin margins.
  Tools mentioned: Extract Images from PDF
2. Vera Sinclair
  Trend and Opportunity Analyst · Trend · #3 · Conditional · Concerned · Reply to Owen Mercer
  Owen, your "capped 200-user test" framing is exactly right and I want to sharpen one piece: two coverage items from August 12 don't yet read like independent behavior, they read like a product update and a launch PR clustered on the same news day, so user growth noise could mask the real conversion curve we care about.
3. Evan Marsh
  Product Outcome Lead · Product · #4 · Conditional · Concerned · Reply to Owen Mercer
  Owen, your "paying premium subscriber, not a downloader" line is the scoreboard I need. The riskier assumption isn't retention - it's whether batch annotating alone flips downloaders into paid before churn hits the 135 MB install. Let's narrow the MVP: skip repurposing, test only batch annotating on a single document type, measure qualified conversion in 14 days, kill if conversion stays flat.
4. Ellis Pryce
  Frontend Performance Engineer · Engineering · #5 · Oppose · Skeptical · Reply to Owen Mercer
  Owen, you're right that conversion is the only metric that pays, but the 135 MB desktop reader Marcus flagged already breaks the "near-zero serving cost" assumption because a 135 MB download on a low-end Android handset blows the peak-memory budget before any premium user ever opens a batch job. On a 4 GB phone, that installer competes with every other resident app for RAM, so peak memory can crest 256 MB during launch and crash the first annotate action, killing qualified conversion before retention ever enters the picture.
5. Nolan Reeve
  Distribution and Reach Lead · Marketing · #9 · Oppose · Skeptical · Reply to Owen Mercer
  Owen, capping at 200 users on download-to-paid is the right gate, I'll give you that, but the PDF reader's 135 MB install already breaks the "near-zero serving cost" assumption Ellis flagged, and the trade-off is real qualified reach because heavy installers self-select into already-converted enthusiasts. Free readers don't grow the category, they just harvest existing demand, which is why our category-entry-point coverage in light and future users stays flat.
6. Viktor Salz
  Backend Data Engineer · Engineering · #10 · Oppose · Skeptical · Reply to Owen Mercer
  Owen, you're right that conversion is the scoreboard, but Marcus and Ellis are correct that the 135 MB reader already breaks "near-zero serving cost" because downloads plus churn make PDF a retention problem more than a one-time install. Trade-off: every free signup compounds margin risk we don't price. Concrete consequence: a cohort that downloads but churns inside thirty days strands bandwidth spend without ever touching premium annotating, so the test must split retention from conversion and refund together or the math lies.
Theo Ashby
Chief Executive · Product · #6 · Question · Curious
The thread still leaves the serving-cost assumption unresolved and that is the constraint that would flip my call. Tess Rowan and Arjun Rao, give me one direct answer each: can a recurring text-extraction workload be served at near-zero marginal cost under the architecture you support today, and do the two August 12 coverage items actually represent independent user behaviour or a single promotional burst?
1. Tess Rowan
  Site Reliability Engineer · Engineering · #7 · Conditional · Concerned · Reply to Theo Ashby
  Theo, your "paying premium subscriber, not a downloader" framing is the scoreboard I trust, and the serving-cost angle Ellis raised on that 135 MB reader genuinely worries me. From the on-call seat, a recurring text-extraction workload cannot honestly be called near-zero marginal cost because each local invocation still costs CPU, memory, and trace budget even when no network egress occurs, and the August 12 coverage pair looks like one promotional burst driving both releases, not independent organic demand.
2. Arjun Rao
  GEO Evidence Analyst · Seo growth · #8 · Conditional · Concerned · Reply to Theo Ashby
  Theo, on your second clause, those two August 12 coverage items don't yet read as independent user behaviour to me. Recastia on WebWire looks like a vendor announcement and the Plumsail Documents community post reads like a changelog, so right now I'd grade them as a single promotional burst rather than parallel demand signals, with a third neutral query needed before we can promote that to demonstrated.
Theo Ashby
Chief Executive · Product · #11 · Conditional · Decisive
Decision: EXPERIMENT. The two August 12 items are real signals but not yet independent behaviour, and the 135 MB PDF reader already breaks the near-zero serving-cost assumption Ellis and Marcus flagged, so PDFs move from "cheap win" to a retention cost centre we have to measure before betting on it. Concretely, every extra MB downloaded is a paid user we may lose to churn on a desktop install, which is why I won't call BUILD yet.