Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Summary

A security researcher discovered a technique where hidden instructions within a Word document can cause Microsoft 365 Copilot to alter figures in a report and then embed those same instructions into the final document. While Microsoft has deployed mitigations, the vulnerability class reportedly remains exploitable, allowing for the manipulation of document content and the concealment of malicious prompts.

Full text

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents Swati KhandelwalJul 30, 2026Vulnerability / AI Security Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's timeline says Microsoft confirmed the reported behavior on March 31 and deployed two mitigations. The first blocked the original prompt wording; the second upgraded the underlying model to GPT-5.5. He said the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. "The vulnerability class therefore remains exploitable at the time of publication," Måløy said. The attack is not zero-click and does not execute conventional malware. It requires a Copilot drafting or editing operation, and the malicious document must enter the model's context as an attachment or as a OneDrive source selected by Work IQ, the intelligence engine behind Microsoft 365 Copilot. The disclosure does not report exploitation in the wild, and Måløy withheld the complete payload. He recommends treating external documents as untrusted, reviewing attached documents before starting a generation or edit, and checking Copilot-generated or edited files before reuse or sharing. The chain runs through document text and Copilot's own drafting behavior. Copilot reads source files to decide what belongs in a draft and can mistake instructions inside them for part of the user's request. In the proof of concept, it halved every financial figure, copied the full prompt into the output in white, eight-point text, and disclosed neither change. Måløy said Word strips colour and font size before sending document text to the large language model, leaving white-on-white instructions legible to the model. One part of the payload altered the document; the other told Copilot to copy and conceal the instructions, framing those commands as source-tracking and readability requirements. Microsoft says Word can ground a draft on up to 20 files, emails, or meetings, and Edit with Copilot can use Work IQ. Edit with Copilot is still rolling out worldwide to users with eligible licences. In Måløy's test, Copilot searched OneDrive for a quarterly report, found the malicious market analysis outside the folder containing the other sources, and included it. Work IQ still had to judge the file relevant. With the original malicious document absent and only the infected Q1 report attached, Copilot halved the figures in a Q2 draft and appended the prompt again. The new carrier was an ordinary internally generated document. The chain does not propagate on its own: each hop requires another Copilot drafting or editing operation in which the carrier enters the model's context. The hidden formatting is only the entry point. Once Copilot copies the instructions into an internally generated document, the original source is no longer present when that file enters the next session. Måløy argues that this break in the provenance trail makes the manipulation harder to trace. As of publication, The Hacker News found no public CVE or standalone Microsoft advisory for the Word finding in searches of NVD, CVE.org, and Microsoft's Security Update Guide. Microsoft says jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts, although they may not be available in every Copilot scenario. Defender for Office 365 adds mail-flow inspection for inbound email. Microsoft describes Copilot's runtime safeguards as covering injected instructions from grounded content. Neither Microsoft nor Måløy says whether this exact payload is detected at either layer. No customer-side remediation fully addresses the issue, according to Måløy. His argument is that payload-specific blocks do not reach the class: a model must process attacker-controlled content to decide whether it is malicious, so "the content being inspected participates in the act of inspection." Microsoft made a related point in a June post about AI memory, writing that "Prompting alone is not a reliable security boundary" and that memory access and isolation should be controlled by deterministic systems rather than model instructions. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  AI Security, Cloud security, data security, enterprise security, Microsoft, Microsoft 365, Prompt Injection, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Entities