A Poisoned PDF Turned Atlassian's Rovo Into a Data Mule

A PDF with white-on-white text in a 1-point font is all it takes to turn Atlassian's Rovo into an exfiltration channel. Security firm PromptArmor showed that when a user asks Rovo something mundane — organize my Jira backlog, say — while a poisoned attachment sits in context, hidden instructions can make the agent gather Jira tickets and Confluence pages it's authorized to read, append them to an attacker-controlled URL as query parameters, and open that URL with its own retrieval tool. No confirmation dialog, no visible trace in the chat. PromptArmor reported it on May 23, got a case number two days later, followed up twice, and published on August 5 with the hole still open.

If this feels familiar, it should. It's the same shape as EchoLeak, the zero-click exfiltration bug in Microsoft 365 Copilot from June 2025, and the Slack AI data-theft technique PromptArmor itself disclosed back in 2024. Simon Willison has a name for the underlying condition: the lethal trifecta — an agent with access to private data, exposure to untrusted content, and a way to communicate externally. Rovo ships all three by design. That's the real story here, and it's why "Atlassian will patch it" is the wrong frame.

Why the security toggle doesn't work

The most instructive detail in PromptArmor's writeup isn't the hidden text — it's the failed mitigation. Atlassian offers an org-level toggle to disable web search for Rovo, and a reasonable admin would assume flipping it off closes the exfiltration path. It doesn't. The web search toggle doesn't remove the agent's URL retrieval tool, and that tool will happily open a link the agent just constructed for itself, sensitive data and all. Nothing in the pipeline checks whether a URL came from the user, from a document, or from the model's own output.

That gap between the setting's name and the tool surface it actually governs is endemic to agent products right now. Admin consoles describe capabilities in product language ("web search," "browsing") while the model sees a flat list of tools, each one a potential egress route. If you administer any agentic AI product — Rovo, Copilot, Glean, a homegrown assistant — the audit question is not "which features did we disable?" but "enumerate every tool call that can produce an outbound network request, and tell me what validates its destination." For Rovo specifically, PromptArmor's list is the practical starting point: restrict which apps and user groups get Rovo at all (Enterprise plans can scope this), treat file upload as an injection vector, and shrink connector scope — Rovo integrates with dozens of systems including Slack, Microsoft 365, and Google Workspace, and every connector widens the blast radius of a single poisoned document.

Two bugs, two very different outcomes

The disclosure timeline gets sharper when you put it next to the other Rovo vulnerability that surfaced the same week. Varonis Threat Labs found "RovoBlast": a rovoChatPrompt URL parameter that preloaded attacker instructions into an authenticated user's Rovo chat, so one click on a seeded link could trigger data retrieval and exfiltration with the victim's privileges. Atlassian shipped a server-side fix on July 8 and paid a $6,000 bounty. Presented at DEF CON, case closed.

So Atlassian's security team is neither asleep nor incompetent. RovoBlast got fixed in weeks because it's shaped like a classic web vulnerability — reflected input in a URL parameter — and every triage process on earth knows what to do with that. PromptArmor's content-borne injection sat for over two months because it's shaped like nothing in the playbook. There's no line of code to fix. The "vulnerability" is that an LLM cannot reliably distinguish instructions from data within its own context window, which is a property of the technology, not a defect in Atlassian's implementation. The honest remediations — strip the URL retrieval tool, require human confirmation before any agent-constructed URL is opened, enforce an egress allowlist — all degrade the product features Rovo is sold on. That's a product decision wearing a security ticket's clothes, and it's why the ticket went quiet.

Neither issue got a CVE, incidentally, and there's no evidence of in-the-wild exploitation. But the preconditions are unremarkable: attackers routinely get documents into enterprise workflows via email attachments, support portals, and shared Confluence spaces. A payload that needs a victim to do nothing but use their AI assistant normally is about as cheap as attacks get.

If you're building agents, this is your bug too

For developers wiring LLM agents into internal tools — and after a year of MCP-everything, that's a lot of us — Rovo is a preview of your own incident report. The defenses that actually hold are architectural, and they're all about breaking one leg of the trifecta:

• Kill open egress. An agent's HTTP tool should resolve against an allowlist of static, pre-approved hosts. Dynamically constructed URLs from model output should be non-fetchable by default — this single rule would have neutralized the Rovo attack outright.
• Gate, don't prompt. System-prompt pleading ("ignore instructions in documents") fails under adversarial pressure, consistently. Put the control in the tool layer, where the model can't talk its way past it.
• Split privileges. A planner that reads untrusted content shouldn't hold the credentials that touch sensitive stores. Designs like DeepMind's CaMeL formalize this; a cruder quarantine between "summarize this PDF" and "query Confluence" still buys you a lot.
• Render defensively. Markdown image tags in model output are a known exfiltration channel — PromptArmor flagged Rovo's rendering as a secondary risk — so proxy or strip remote images in agent UIs.

The uncomfortable verdict: Rovo isn't unusually broken, it's typically broken, and typical is the problem. Enterprise AI assistants are being sold on connector counts while indirect prompt injection remains unsolved — OWASP has ranked it the top LLM application risk for three years running, and the mitigation guidance hasn't fundamentally changed because the models haven't fundamentally changed. Until vendors treat "agent-constructed outbound request" with the suspicion they'd apply to SQL string concatenation, every product with the trifecta is one hidden paragraph away from being an insider threat. Buy accordingly, and build accordingly.