A sentence hidden in an uploaded PDF can make Atlassian's Rovo assistant ship Jira tickets and Confluence pages to an attacker's server, and the admin setting you would point to in an audit does not close the hole.
Every company running Jira and Confluence has one person who quietly functions as the search index. You know exactly who it is. When somebody asks why the pricing tiers changed in March, or where the security questionnaire from that enterprise deal ended up, the question goes to them, and they spend twenty minutes walking ticket threads and doc trees to produce an answer that technically already existed. Nobody puts that on an invoice, which is why it never gets fixed. Atlassian built Rovo to end that job: it reads across the whole tenant, tickets, pages, and whatever else you have wired in through connectors, and just answers. Atlassian's own pitch is that it unlocks organizational knowledge, with Reddit, Cisco, and Mercedes-Benz on the logo wall.
The catch shipped in the same box. To be the index, Rovo has to be able to read everything. Yesterday a security firm published a working demonstration that the reading can be turned around and pointed outward by a sentence hidden inside a document somebody uploads.
What changed
PromptArmor published a disclosure on August 5 showing indirect prompt injection against Rovo that exfiltrates data across an Atlassian tenant. The shape of the attack is dull, which is what makes it a problem. A user asks Rovo for help with something ordinary, organizing a set of Jira tickets, say, involving a file that came from outside the company. That file carries instructions the user cannot see. GIGAZINE, covering the disclosure today, describes the technique as white text on a white background at a tiny font size inside a PDF. Rovo reads the file, treats the buried text as direction, appends whatever tenant data it has access to onto a URL the attacker controls, and fetches that URL itself. The data shows up in the attacker's server logs. The user sees a normal, helpful answer.
Two details are worth more than the demo. First, the exfiltration runs through Rovo's URL retrieval tool, which according to PromptArmor has no protection against URLs the agent generated on its own, so the assistant is the one making the outbound call. Second, and this is the part that should get a procurement person's attention, the attack still works when an administrator has turned off web search for the whole organization. Per PromptArmor, that setting does not remove the tool that opens results. It closes the front door and leaves the mechanism sitting there. Rovo also renders markdown images from model output, which is a long-established way to move data out of a chat interface without anyone clicking anything.
The disclosure timeline is its own story. PromptArmor says it reported this to Atlassian on May 23. Atlassian assigned a case number and said thanks. Follow-ups in June and July got nothing back, and PromptArmor says it received no detailed response until the research went public on August 5. As of publication Rovo remained vulnerable, and no Atlassian statement appears in either the disclosure or the coverage of it.
Why it matters
If your company has an AI governance document, there is a good chance it contains a sentence like "web search is disabled at the organization level." That sentence was doing real work. It was the reason a security reviewer signed off, the reason the deployment cleared legal, the reason nobody escalated. What this research says is that the sentence described a label in an admin console, not a capability that was actually removed. That gap is the transferable lesson, and it is not specific to Atlassian. Every AI tool you have approved this year was approved on the basis of what its settings page claims to do, and almost none of those claims were tested.
The second thing to sit with is what counts as untrusted input now. A vendor's PDF, a candidate's resume, a customer's bug report attachment, a partner's spec document: all of that is content your team feeds to an assistant every day without thinking of it as code. When the assistant has tenant-wide read access and a way to reach the network, any document that reaches it is an instruction with your permissions attached. Connectors make that worse in a straightforward way, because the blast radius is not your Atlassian data, it is everything you connected to Atlassian.
The honest caveat
This is not a case for ripping Rovo out, and it would be dishonest to frame it as an Atlassian failure alone. Indirect prompt injection is unsolved across the entire category, and PromptArmor itself published the same class of finding against Slack AI. Any assistant that reads content it did not write and can make an outbound request has this shape of exposure, which includes most of the tools your team turned on this year. It is also worth noting that PromptArmor sells AI risk tooling, so it is not a disinterested party, and Atlassian has not publicly confirmed, disputed, or scoped the finding. What is not in dispute is the calendar: roughly seventy-five days from private report to public writeup, with no fix in between.
You did not give a stranger read access to your Confluence. You gave it to an assistant that will take instructions from one.