Hidden Text in PDFs Can Hijack AI Assistants Through Prompt Injection Attacks

Security researchers have demonstrated a new prompt injection attack capable of hiding malicious instructions inside ordinary-looking PDF files and using them to manipulate AI assistants. The vulnerability was demonstrated against Atlassian Rovo, an enterprise AI assistant designed to search workplace data, summarize documents, and interact with business tools. Researchers found that attackers could embed instructions using invisible or nearly invisible text that a human opening the PDF would not notice, but the AI system would still read and potentially treat as legitimate commands. 

The attack highlights a growing cybersecurity problem as companies give AI agents access to sensitive documents, internal databases, email, cloud applications, and automated actions. Unlike a conventional malicious prompt typed directly into a chatbot, this technique uses indirect prompt injection, where the malicious instructions are hidden inside information the AI has been asked to process. 

Malicious Instructions Can Be Hidden From Humans

The attack takes advantage of the difference between what a person sees when opening a PDF and what an AI model extracts from the document.

Attackers can embed text that is effectively invisible to the reader while remaining accessible to software parsing the file. When an AI assistant analyzes the PDF, the hidden instructions become part of the information sent to the model.

The AI can then have difficulty distinguishing between the legitimate document content and instructions deliberately planted by an attacker.

That means an employee could upload what appears to be a normal business document without realizing it contains commands specifically targeting the company’s AI assistant. 

Researchers Targeted Atlassian Rovo

The researchers demonstrated the technique against Atlassian Rovo, an AI-powered workplace assistant integrated with products including Jira and Confluence.

Rovo is designed to do considerably more than simply answer questions. It can search workplace information and interact with enterprise tools, which potentially increases the consequences of successful prompt injection.

An attacker could attempt to hide instructions directing the AI to ignore the user’s original request and instead perform an action chosen by the attacker. 

Indirect Prompt Injection Is the Bigger Problem

This attack belongs to a category known as indirect prompt injection.

A conventional prompt injection might involve someone directly telling an AI system to ignore its previous instructions.

Indirect prompt injection is more difficult to detect because the malicious command can be buried inside something the AI is processing, including a:

• PDF
• Webpage
• Email
• Document
• Support ticket
• Database entry

The user interacting with the AI may never see the malicious instructions.

The assistant simply encounters them while performing the legitimate task it was given. 

AI Agents Make Prompt Injection More Dangerous

The security risk becomes substantially greater when AI systems are allowed to take actions instead of simply generating text.

An AI chatbot that gets manipulated might produce an incorrect answer. An AI agent connected to business systems could potentially have permission to interact with sensitive information or perform actions on a user’s behalf.

The danger depends heavily on what permissions the AI has been granted. This is why security researchers increasingly recommend limiting autonomous agents to the minimum permissions necessary for their jobs and requiring human approval before sensitive actions are executed. 

The PDF Itself Does Not Need Traditional Malware

One of the most unusual aspects of prompt injection is that the malicious document does not necessarily need executable malware.

The attack instead targets the AI model interpreting the document.

A PDF can therefore appear harmless to conventional security tools because the dangerous component is essentially natural-language instructions designed to manipulate an AI system rather than executable computer code.

That creates a new challenge for cybersecurity systems originally designed to identify viruses, malicious scripts, suspicious attachments, and conventional exploits.

AI Security Is Becoming a Major Cybersecurity Battleground

The discovery arrives as AI cybersecurity capabilities are advancing rapidly.

Frontier AI models are increasingly being used to analyze software repositories, discover previously unknown vulnerabilities, and assist cybersecurity researchers. Decrypt recently reported that advanced models are already being deployed against browsers, operating systems, open-source software, and cryptocy infrastructure. 

But prompt injection demonstrates another side of the problem. As organizations integrate AI deeper into everyday operations, attackers do not necessarily need to break the underlying AI model. Instead, they may be able to manipulate the information the model consumes.