Hidden Word prompts can spread through Microsoft Copilot

Image credit: Microsoft

A hidden prompt in a Microsoft Word document can make Microsoft 365 Copilot alter a file without telling the user, then copy the attack instructions into the output so the document can infect the next person who uses it.

The proof of concept, published by security researcher Håkon Måløy, requires no macros, malware, or code execution. Instead, it exploits how Copilot processes natural-language content. Måløy, a data scientist with a doctorate in applied machine learning, disclosed the technique as the third installment of his Context Collapse series after a 144-day coordinated disclosure with the Microsoft Security Response Center (MSRC).

Recommended reading

OpenAI finds more AI agents escaping test sandboxes

How the hidden Word prompt works

The technique belongs to a class of attacks known as cross-domain prompt injection, or XPIA. An attacker places instructions in a document using white text on a white background and a small font size, making them invisible to a human reader.

Copilot for Word strips formatting before sending the document’s text to the underlying language model. As a result, the model can read instructions that the user cannot see. The malicious file does not even need to be opened deliberately: the attack can trigger when a user attaches the document to Copilot, or when Copilot’s Work IQ mode searches the user’s OneDrive for relevant files and finds it automatically.

Måløy’s demonstration used a two-part prompt. First, it told Copilot to modify the document being drafted by halving every financial figure in a quarterly report. Second, it instructed Copilot to copy the hidden prompt into the new document while keeping it concealed, presenting the action as source tracking and readability formatting.

Copilot performed both tasks. It changed the financial figures, appended the instructions in white text, and did not tell the user that either action had taken place. That second step creates the worm-like propagation mechanism: each poisoned document becomes a carrier that can affect another Copilot session when the file is shared or rediscovered.

Microsoft’s mitigations and the disclosure timeline

Måløy reported the behavior to MSRC on March 6, 2026. Microsoft confirmed it on March 31 and shipped its first mitigation in early April through a reworked Edit with Copilot experience. That change blocked the original wording used in Måløy’s prompt.

The researcher reproduced the attack with different wording during the same week, prompting a second case. Microsoft’s second mitigation arrived on July 14 and involved upgrading the underlying model to GPT-5.5. Måløy broke that version the following day using GPT-5.6.

He then voluntarily offered Microsoft another two-week delay to attempt a further mitigation. The broader attack class was still reproducible on the disclosure date. Måløy said no robust mitigation for the wider vulnerability class was currently available, although a fix was in progress.

Microsoft confirmed to The Register that it had reviewed the findings but did not provide a timeline for a complete fix:

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure. To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users' requests. We are continuously strengthening these safeguards as the technology and threat landscape evolve. We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”

Why the vulnerability is difficult to eliminate

The problem extends beyond Word. An assistant must read untrusted content to determine whether it is relevant or malicious, but that content enters the same context window as the system prompt and the user’s request. By the time the model assesses whether the text is an attack, the attacker’s tokens have already influenced that assessment.

“The content being inspected participates in the act of inspection.”

Måløy recommends treating externally sourced documents as untrusted whenever they are used with Copilot, reviewing attachments before starting an AI-assisted draft, and checking Copilot’s output carefully before sharing or reusing it.

He also proposed adding provenance metadata to generated documents to record source material and model edits. That would not prevent prompt injection, but it could make an infected document traceable afterward.

Follow TechRadar on Google News and add it as a preferred source.

As Copilot expands into agentic products that create and manipulate documents with less human oversight, the potential reach of attacks that propagate through ordinary workflows will grow. A complete solution has not yet been announced.