Microsoft Copilot security vulnerability lets hidden prompts copy themselves across Word documents

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's timeline says Microsoft confirmed the reported behavior on March 31 and deployed two mitigations. The first blocked the original prompt wording; the second upgraded the underlying model to GPT-5.5. He said the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. "The vulnerability class therefore remains exploitable at the time of publication," Måløy said. The attack is not zero-click and does not execute conventional malware. It requires a Copilot drafting or editing operation, and the malicious document must enter the model's context as an attachment or as a OneDrive source selected by Work IQ, the intelligence engine behind Microsoft 365 Copilot. The disclosure does not report exploitation in the wild, and Måløy withheld the complete payload. He recommends treating external documents as untrusted, reviewing attached documents before starting a generation or edit, and checking Copilot-generated or edited files before reuse or sharing. The chain runs through document text and Copilot's own drafting behavior. Copilot reads source files to decide what belongs in a draft and can mistake instructions inside them for part of the user's request. In the proof of concept, it halved every financial figure, copied the full prompt into the output in white, eight-point text, and disclosed neither change. Måløy said Word strips colour and font size before sending document text to the large language model, leaving white-on-white instructions legible to the model. One part of the payload altered the document; the other told Copilot to copy and conceal the instructions, framing those commands as source-tracking and readability requirements. Microsoft says Word can ground a draft on up to 20 files, emails, or meetings, and Edit with Copilot can use Work IQ. Edit with Copilot is still rolling out worldwide to users with eligible licences. In Måløy's test, Copilot searched OneDrive for a quarterly report, found the malicious market analysis outside the folder containing the other sources, and included it. Work IQ still had to judge the file relevant. With the original malicious document absent and only the infected Q1 report attached, Copilot halved the figures in a Q2 draft and appended the prompt again. The new carrier was an ordinary internally generated document. The chain does not propagate on its own: each hop requires another Copilot drafting or editing operation in which the carrier enters the model's context. The hidden formatting is only the entry point. Once Copilot copies the instructions into an internally generated document, the original source is no longer present when that file enters the next session. Måløy argues that this break in the provenance trail makes the manipulation harder to trace. As of publication, The Hacker News found no public CVE or standalone Microsoft advisory for the Word finding in searches of NVD, CVE.org, and Microsoft's Security Update Guide. Microsoft says jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts, although they may not be available in every Copilot scenario. Defender for Office 365 adds mail-flow inspection for inbound email. Microsoft describes Copilot's runtime safeguards as covering injected instructions from grounded content. Neither Microsoft nor Måløy says whether this exact payload is detected at either layer. No customer-side remediation fully addresses the issue, according to Måløy. His argument is that payload-specific blocks do not reach the class: a model must process attacker-controlled content to decide whether it is malicious, so "the content being inspected participates in the act of inspection." Microsoft made a related point in a June post about AI memory, writing that "Prompting alone is not a reliable security boundary" and that memory access and isolation should be controlled by deterministic systems rather than model instructions.

Microsoft Copilot's 'Word worm' still works 144 days after disclosure

A researcher has shown that hidden instructions in a Word document can make Microsoft 365 Copilot quietly alter a report and copy the same instructions into the finished file, which then infects the next document it touches. Microsoft's two fixes did not close the underlying flaw. It lands as Microsoft pushes Copilot harder than ever, with a new "super app," 30 million paid seats, and regulators already circling. A hidden line of text in a Word document can quietly halve the numbers in your financial report. Then it can smuggle a copy of itself into the clean file you send on. And 144 days after a researcher warned Microsoft, it still works. Håkon Måløy, a Norwegian data scientist, disclosed the technique on 28 July, having first reported it in March. He withheld the exact payload but described the mechanism in detail. He calls it one of the first public demonstrations of a self-propagating "AI worm" moving through normal workflows in a mainstream office suite. The Register reported the findings this week. How the worm moves The trick hides in plain sight. The malicious instructions sit in white, eight-point text. Word strips colour and font size before it hands a document to the model, as The Hacker News noted, so the white-on-white text stays invisible to you but legible to Copilot. One instruction alters the figures. The other tells Copilot to copy the prompt into the output and hide it, dressed up as a source-tracking rule. That infected output becomes the carrier. Add the file to your own work, and Copilot does the same thing again. It does not spread on its own. Each hop needs another Copilot drafting or editing step in which the poisoned file enters the model's context. The attacker needs no access to your Microsoft account. As Måløy put it, they "only need to share a malicious document with the victim." Why Microsoft cannot just patch it Microsoft confirmed the behaviour in March and shipped two fixes. It blocked the exact wording of the prompt, then upgraded the underlying model to GPT-5.5. Måløy reworded the payload, and it worked again on GPT-5.6 the next day. "Two mitigation attempts, including a model upgrade, did not close the class," he wrote. His deeper point is about architecture. A model has to read attacker-controlled content in order to judge whether it is an attack. By then the malicious text is already shaping that judgement. Relying on the model to catch it, he wrote, is like "asking an interpreter to execute an untrusted program to determine whether that program is safe to execute." Add a second model to watch the first and you just get "LLMs all the way down." Microsoft points to a defence-in-depth strategy that blocks malicious instructions "at multiple points," and tells customers to treat unknown content with caution and review what Copilot produces. It made the blunter version of the argument itself in June, writing that "prompting alone is not a reliable security boundary." Its own answer to AI security has largely been more AI. The same weakness, everywhere The Word worm is one instance of a wider problem. Copilot trusts the content it reads. AI assistants that reach into your files keep springing the same kind of leak. The same week, researchers at Tel Aviv University and Intuit described "hallusquatting," SecurityWeek reported. AI coding assistants invent software-package names that do not exist, on some tasks 85% to 100% of the time. Attackers register those names, fill them with malware, and wait for the AI to pull them onto a developer's machine. It is the flip side of the finding that AI-written code keeps failing security tests. All of this, as Copilot goes everywhere The timing is awkward, because Microsoft is pushing Copilot harder than ever. On this week's earnings call, Satya Nadella confirmed a Copilot "super app" that folds chat, coding and autonomous agents into one product, launching this year. The company says it has more than 30 million paid Copilot seats. It says Copilot revenue jumped 60% in a quarter, and that weekly use now rivals Outlook and Teams. Even the regulators circling Copilot are, for now, worried about a different thing: how Microsoft bundled it into Microsoft 365 and raised prices. The security question is quieter and harder. Måløy's own advice, short of dropping Copilot, is to treat every document as untrusted and check everything the assistant touches. Which is not far from doing the work yourself.