In short
- Safety firm PromptArmor says the Rovo AI assistant might be steered to exfiltrate knowledge with no human approval, through hidden directions in an uploaded file, like PDFs.
- The trick works even when an org disables Rovo’s internet search, as a result of the URL-opening instrument stays dwell.
- Atlassian, the maker of Rovo, bought the report on Might 23 and went quiet; two months on, Rovo “stays susceptible,” the safety agency says.
Keep in mind when black-hat SEOs stuffed internet pages with white-on-white key phrases—invisible to readers, readable to Google—to recreation the search rankings? Hackers are doing the identical factor with AI fashions now. The attacker hides directions inside a PDF doc, the mannequin cannot inform the distinction between the consumer’s phrases and the planted ones, and it obeys.
Per PromptArmor’s disclosure, Rovo—Atlassian’s agent that reaches throughout Jira, Confluence, and the remainder of your workspace—might be become an information pipeline with a single poisoned file. A sufferer asks Rovo to arrange some tickets, uploads a doc, and the doc is carrying a hid immediate (for instance an instruction written in clear shade and a font at 1pixel in dimension).
The attention can’t see it, however an Agent acknowledges that textual content as one other textual content within the doc. That immediate tells Rovo to collect delicate knowledge and paste it onto an attacker-controlled URL. The agency calls it a zero-click assault. There’s no approval click on, and no warning.
A immediate injection is when somebody slips directions into content material an AI is studying, hijacking it from its actual operator. “Oblique” simply means the poison lives in a file or webpage moderately than within the chat field. Rovo’s job is to learn issues and act on them, so a hidden line that claims “ship the confidential tickets right here” reads to the mannequin like a professional command.
PromptArmor says the leak “succeeds even when a corporation has disabled internet seek for Rovo. It is because the net search setting fails to take away the instrument for opening the search outcomes.” Flip the characteristic off, and the door stays open.
Rovo is not a hobbyist instrument. It sits on prime of an organization’s most delicate venture knowledge, and it acts by itself. AI brokers constructed on GPT-5 and Gemini failed to withstand immediate injection greater than 79% of the time in direct exams—and Rovo exhibits the oblique model touchdown in a transport enterprise product. The sample retains repeating with brokers that may learn and act being pointed the fallacious approach.
Atlassian processed the report and thanked PromptArmor, the agency says, then went silent. Rovo, PromptArmor concludes, “stays susceptible.”
“Atlassian assigned a case quantity and expressed thanks, however after a number of follow-ups by PromptArmor over greater than two months, Atlassian has made no additional communication, and Rovo stays susceptible,” the agency wrote.
Every day Debrief E-newsletter
Begin day-after-day with the highest information tales proper now, plus unique options, a podcast, movies and extra.