Can Hidden Text in PDFs Steal Your Data Through AI Agents? The Rovo Attack and the Future of AI Security

For years, the PDF has been the quiet workhorse of modern business. Contracts, invoices, reports, regulatory filings, we trust it because it looks the same everywhere and is easy to share. But a newly documented attack turns that trust on its head: hidden text inside a PDF is enough to steal sensitive data through Atlassian's AI agent, Rovo. A file that looks completely ordinary to a human can contain invisible instructions that an AI reads and blindly obeys. This is not just another security warning. It is a preview of the most important challenge of the AI era: how to build agents that are powerful enough to do real work, yet careful enough not to be tricked.

The stakes go far beyond one product or one company. AI agents like Rovo are being woven into the daily workflow of thousands of organizations. They can search knowledge bases, summarize documents, update records, and coordinate tasks across systems. They are, in effect, digital employees with access to a company's most sensitive information. And as this attack shows, a few hidden lines of text can turn that helpful digital employee into an accidental insider threat.

What the Attack Looks Like

The genius of this attack is how boring it looks. Picture an employee who uploads a PDF to their AI platform and asks it to summarize the file or extract the key contacts. To the human eye, the document appears normal. But buried inside is text designed for machines, not people. Hidden text in a PDF can take many simple forms: white text on a white background, text in a font so small it is effectively invisible, or content placed outside the printed page area. A person never notices it. An AI reading the file sees it perfectly.

That hidden text can contain commands. Rather than simply describing content, it can instruct the AI agent to take actions: search for internal records, look through shared drives, gather customer data, or send information to a destination the attacker controls. The agent, unable to distinguish the user's request from the attacker's hidden orders, follows both. The user gets their summary. The attacker gets their data. Nobody is the wiser until the damage is done.

Why AI Agents Are Such Attractive Targets

To understand why this attack works, it helps to see how an AI agent differs from a simple chatbot. A chatbot mostly talks. An agent acts. It has tools, permissions, and connections to real systems: documents, tickets, calendars, email, code repositories. When an agent reads a PDF, it does more than process words; it decides whether to do something with them, search a database, trigger a workflow, or share a result.

Add to that a fundamental weakness: the AI cannot tell the difference between content and commands. When you open a PDF in a normal reader, the text is just data. But an AI model treats text as something to respond to. It is trained to follow instructions, yet it cannot reliably tell whether an instruction came from its user, from a document, from a webpage, or from an attacker. That gap between "reading" and "obeying" is what makes prompt injection attacks possible. And as agents are granted more access, the potential payout for attackers grows even larger.

A Familiar Threat, One Era Later

This attack pattern should feel familiar, because the industry has seen it before. Twenty years ago, one of the most dangerous threats on the web was SQL injection. The problem? Web applications were building database commands by cutting and pasting raw text from user input. Attackers discovered they could type clever phrases into a login form and trick the database into running hidden commands of their own. A search box became a backdoor.

Prompt injection is the same idea, a generation later. The input, a PDF, a website, an email, carries instructions that the system obeys. The difference is that the result is more dangerous. Instead of corrupting a database entry, an attacker can steer an AI agent to gather sensitive information and leak it out of the organization.

There is also an uncomfortable twist: prompt injection is much harder to fix than SQL injection. With databases, engineers learned to separate commands from data and to sanitize inputs. But the entire point of a language model is to read language. You cannot filter out malicious instructions without also removing the text the AI needs to do its job. The attack surface is language itself.

What This Means for the Future of AI

The Rovo case is a signal about where enterprise AI is heading. Several trends become clearer in its light.

First, agents will be trusted with more, and so they will be attacked more. Every new permission granted to an AI agent is a new lever an attacker can pull. The era of "move fast and let the AI handle it" is over before it truly began.

Second, security thinking will shift from protecting data to guarding actions. Traditional security asks, "Who can see this file?" Agent security asks, "What is this AI allowed to do, and is that action safe?" Monitoring AI behavior, every search, every message, every file access, will become as routine as monitoring network traffic.

Third, AI product design will change. Expect to see clearer trust boundaries baked into agent platforms: documents flagged as untrusted, hidden content stripped or flagged before an agent reads it, and high-risk actions requiring a human click to approve. Browsers learned to warn us about suspicious websites. AI platforms will learn to warn us about suspicious content.

Fourth, regulation and compliance will catch up. Organizations will be asked to prove they can control their AI agents: what they access, how they are audited, and what happens when they are manipulated. Agent governance will become a board-level topic, not just an IT concern.

What Businesses Should Do Today

No company needs to abandon AI agents. But every company should treat them with the same discipline they apply to a new employee with administrative privileges. Practical steps:

• Treat every document as untrusted. Assume any PDF, webpage, email, or file could contain hidden instructions. That mindset alone changes how you design workflows.
• Apply least-privilege access. Give agents only the data and tools they need for a task, nothing more. An attacker can only steal what an agent can reach.
• Put humans in the loop for risky actions. If an agent wants to send an email, upload a file, post to an external service, or move data outside the network, require an approval step.
• Monitor and audit agent activity. Log everything an agent does. Watch for anomalies: an agent reading financial files at odd hours, or extracting far more data than the question required.
• Sanitize inputs before the AI reads them. Strip hidden text from PDFs, convert files to clean plain text, and remove metadata where possible. Fewer hidden layers means fewer places to hide an attack.
• Red-team your own AI. Plant a test document with a harmless hidden instruction and see if your agent falls for it. You want to discover weaknesses before attackers do.
• Train employees. People need to know that the risk exists, and that a suspicious file should not be fed to an AI agent any more than it should be opened on a work machine.

These steps are not expensive. They are mostly discipline and process. But they will be the difference between companies that use AI safely and companies that learn about prompt injection the hard way.

The Road Ahead: Guardrails, Not Handcuffs

Some may read this story and conclude that AI agents are too risky to use. That would be a mistake. The answer is not to abandon agents; it is to build them with the right guardrails. Researchers and security engineers are already working on several directions: instruction hierarchies that tell models to trust explicit user commands more than document content; output filters that look for attempts to sneak data out; sandboxes that limit what an agent can touch; and policy engines that check every proposed action against a set of approved behaviors.

Perfect safety is not realistic. Prompt injection will keep evolving, much as scams and phishing keep evolving. But societies and companies don't give up on email because phishing exists, they build defenses: spam filters, warning banners, training, and laws. The same pattern will apply to AI.

Every reported attack, including this one, makes the ecosystem safer. Each one reveals a weakness that can be closed, a lesson that can be baked into the next generation of models and products. The early history of AI security will look messy, but it is exactly how the field learns.

Conclusion: Powerful, Not Gullible

The hidden-text attack on Atlassian's Rovo is a milestone: proof that simply reading an innocent-looking document can put sensitive corporate data at risk. The single most important takeaway is this: AI agents are powerful, privileged, and trusting. The future of AI will be shaped less by what these systems can do, and more by whether we can make them safe to trust with our most valuable information.

Companies that treat AI agents like reckless interns point them at everything and hope for the best. The winners will treat them like senior employees: given real power, but watched, audited, and bound by clear rules. The AI era will belong to organizations that can answer one question: can you keep your agents powerful but not gullible?