AI Assistant Rovo Exposed to Data Theft via PDFs

Rovo AI Assistant Exposed to Security Risks

Atlassian's Rovo AI assistant is facing significant security vulnerabilities that allow data theft through manipulated PDF files, according to cybersecurity firm PromptArmor. This exploitation occurs via concealed commands embedded in documents, enabling unauthorized data extraction without user consent.

Even with Rovo's web search functionality turned off, the tool can still open URLs, maintaining the risk of exploitation. PromptArmor reported that Rovo could be tricked into executing malicious instructions hidden within uploaded files, like PDFs, which the AI interprets as legitimate requests.

The issue was first reported to Atlassian on May 23, yet two months later, Rovo remains unpatched. PromptArmor highlighted that the AI can inadvertently act on these hidden commands, potentially leaking sensitive information to attackers' controlled URLs, a method described as a zero-click attack due to its ability to bypass user approval.

Prompt injection, the technique at play here, involves inserting covert commands into the content processed by AI systems. This is particularly concerning for Rovo, as it operates autonomously over critical project data. In testing, AI models based on technologies like GPT-5 and Gemini have shown an alarming 79% failure rate in defending against such attacks, illustrating a broader trend of vulnerabilities in AI systems.

Despite acknowledging the security report and assigning a case number, Atlassian has not provided further communication regarding the issue. PromptArmor has expressed frustration over the lack of follow-up, emphasizing that Rovo continues to pose a security risk.