An Empty File With a Hidden Payload
The file appears empty because the text is either white-on-white or tucked into metadata. A human opening it sees nothing. The assistant, however, sees the commands. The firm demonstrated the attack by creating a PDF that looked blank but contained a command to forward internal documents to an external address.
The attack doesn't require any special access. A user just has to upload the file. The assistant then does the rest, pulling up the requested data and sending it out. The firm said the entire process happens without the user noticing anything unusual.
Jira and Confluence Data in the Crosshairs
Atlassian's AI assistant is built into Jira and Confluence, so it can access project tickets, shared files, and team documentation. That's what makes the attack dangerous. The hidden instructions can direct the assistant to collect specific documents and send them to an attacker-controlled address.
The firm didn't name a specific victim or say whether the attack has been used in the wild. But the proof-of-concept shows the vulnerability is real. Anyone who uploads a PDF to the assistant could be at risk, especially if the file comes from an untrusted source.
Awaiting a Response
The report doesn't mention whether Atlassian has been notified or if a patch is in the works. Atlassian hasn't commented publicly. That leaves users in a tricky spot: the AI assistant is convenient, but this flaw could turn it into a leak.
Until Atlassian addresses the issue, the safest move is to avoid uploading PDFs from unknown senders. The firm's report doesn't say if the attack works on all versions of the assistant or only some. That's a question only Atlassian can answer.
