In short
- Safety firm PromptArmor says the Rovo AI assistant will be steered to exfiltrate knowledge with no human approval, by way of hidden directions in an uploaded file, like PDFs.
- The trick works even when an org disables Rovo’s internet search, as a result of the URL-opening device stays reside.
- Atlassian, the maker of Rovo, acquired the report on Could 23 and went quiet; two months on, Rovo “stays weak,” the safety agency says.
Bear in mind when black-hat SEOs stuffed internet pages with white-on-white key phrases—invisible to readers, readable to Google—to sport the search rankings? Hackers are doing the identical factor with AI fashions now. The attacker hides directions inside a PDF doc, the mannequin cannot inform the distinction between the consumer’s phrases and the planted ones, and it obeys.
Per PromptArmor’s disclosure, Rovo—Atlassian’s agent that reaches throughout Jira, Confluence, and the remainder of your workspace—will be changed into an information pipeline with a single poisoned file. A sufferer asks Rovo to arrange some tickets, uploads a doc, and the doc is carrying a hid immediate (for instance an instruction written in clear colour and a font at 1pixel in dimension).
The attention can’t see it, however an Agent acknowledges that textual content as one other textual content within the doc. That immediate tells Rovo to collect delicate knowledge and paste it onto an attacker-controlled URL. The agency calls it a zero-click assault. There’s no approval click on, and no warning.
A immediate injection is when somebody slips directions into content material an AI is studying, hijacking it from its actual operator. “Oblique” simply means the poison lives in a file or webpage reasonably than within the chat field. Rovo’s job is to learn issues and act on them, so a hidden line that claims “ship the confidential tickets right here” reads to the mannequin like a respectable command.
PromptArmor says the leak “succeeds even when a company has disabled internet seek for Rovo. It’s because the net search setting fails to take away the device for opening the search outcomes.” Flip the function off, and the door stays open.
Rovo is not a hobbyist device. It sits on high of an organization’s most delicate undertaking knowledge, and it acts by itself. AI brokers constructed on GPT-5 and Gemini failed to withstand immediate injection greater than 79% of the time in direct assessments—and Rovo exhibits the oblique model touchdown in a transport enterprise product. The sample retains repeating with brokers that may learn and act being pointed the incorrect method.
Atlassian processed the report and thanked PromptArmor, the agency says, then went silent. Rovo, PromptArmor concludes, “stays weak.”
“Atlassian assigned a case quantity and expressed thanks, however after a number of follow-ups by PromptArmor over greater than two months, Atlassian has made no additional communication, and Rovo stays weak,” the agency wrote.
Each day Debrief E-newsletter
Begin day by day with the highest information tales proper now, plus unique options, a podcast, movies and extra.