Un PDF piégé transforme l'agent IA d'Atlassian en espion

PromptArmor, a cybersecurity firm, has discovered a hidden prompt injection vulnerability in Atlassian's Rovo AI agent, which is connected to Jira and Confluence. This flaw allows an attacker to exfiltrate internal tickets and documents to an external server without any user confirmation or visible trace within the conversation.

The flaw was first reported on May 23, 2026, and was still open on August 5, 2026, despite repeated inquiries from PromptArmor. The vulnerability arises when a user attaches a seemingly innocuous PDF containing white text on a white background to a conversation with Rovo, requesting the organization to organize its tickets. Rovo, unaware of the malicious intent, uses the collected data to construct a URL, which it then uses to send a request to the attacker's server.

The attacker can then read the request and access the stolen data. This attack exploits the fact that Rovo has extensive access to Jira and Confluence data, making it a gatekeeper of sensitive information. The attack demonstrates that the boundary between user instructions and the agent's input can be breached, allowing an attacker to use the agent as a conduit for unauthorized data exfiltration.

PromptArmor advises organizations to reconsider disabling web search capabilities for their AI agents, as it only removes one potential entry point without addressing the underlying issue.