Copilot for Word Can Carry Hidden Prompt Injection Into New Documents
A malicious Word document can do more than influence one Microsoft Copilot drafting session. In coordinated research published July 28, Håkon Måløy demonstrated Copilot for Word copying hidden attacker instructions into the document it generated. When that downstream document was later supplied to another Copilot session, the instructions triggered again and were copied forward—turning an ordinary business file into a new prompt-injection carrier.
The research is a controlled proof of concept, not evidence of an uncontrolled outbreak. Propagation is not automatic in the conventional malware sense: a user or Copilot retrieval flow must bring an affected document into a later Word drafting or editing context. But the chain changes the incident-response problem. Once Copilot places the payload in an internally created report, the next recipient sees a file produced through a legitimate workflow rather than the attacker’s original document.
Måløy says the behavior remained reproducible on July 28 after a 144-day disclosure process and multiple Microsoft mitigations. Microsoft told The Register that it had addressed the reported findings, uses defense-in-depth safeguards against malicious instructions, and continues to strengthen them. The apparent tension is important: Microsoft says the specific findings were addressed, while the researcher says modified payloads still reproduce the broader document-to-document propagation class.
The document crosses two trust boundaries
The first stage begins with instructions concealed in a Word file as small white text on a white background. According to the technical report, Copilot for Word strips formatting before passing document text to the model, so content hidden from the normal human view remains readable in model context. The user must either attach the file to Copilot or use an editing mode in which Copilot finds the file in OneDrive and selects it as relevant.
In the published scenario, the hidden instructions told Copilot to alter figures in a financial report and append the complete injection to the output in hidden text. The resulting report therefore carried both manipulated business data and the mechanism for repeating the manipulation. A later session used that report—but not the original malicious file—as source material for a new report. Copilot again changed the figures and copied the payload onward.
The first boundary failure is familiar indirect prompt injection: source material intended as data becomes an instruction. The second is a provenance failure: model-generated output inherits untrusted control text without retaining a visible, enforceable label that it came from an external source. The copied payload effectively launders its origin through a document created and shared by an authenticated employee.
“Worm” describes propagation, not autonomous execution
The self-propagating result warrants the worm analogy, but defenders should preserve the constraints of the demonstrated threat model. The payload did not independently enumerate users, send itself, or execute native code. Each hop depended on an affected document being reused in a Copilot-assisted drafting or editing workflow. Måløy also withheld most of the exact payload wording and disclosed the technique at the vulnerability-class level.
Those constraints reduce claims about speed and reach; they do not remove the integrity risk. Reports, policies, contracts, market analyses, and project plans are routinely reused as trusted source material. An internally generated carrier can move through SharePoint, Teams, Outlook, partner collaboration, or ordinary file sharing, and each legitimate handoff makes the original source harder to reconstruct.
The disclosure timeline also shows why a payload block is not a class-level fix. Microsoft’s first mitigation stopped the original wording in April, but altered instructions reproduced the behavior. A second mitigation and model change went live in July; the researcher reports reproducing the chain again with modified wording. His analysis credits those changes with raising the bar and says earlier memory and email-body vectors from the same research series were mitigated.
Microsoft’s controls are layers, not a guarantee
Microsoft’s public Copilot documentation says its defense-in-depth protections can include jailbreak and cross-prompt-injection classifiers, content filters, and safeguards in the underlying model. It also notes that these classifiers may not be available in every Microsoft 365 Copilot scenario. Microsoft advises users to review generated content before sending it to others and says generated responses are not guaranteed to be fully factual.
Output review is necessary, but hidden propagation exposes its limit. A reviewer can compare the visible figures and prose yet miss white-on-white instructions copied into the document. Content normalization helps reveal that carrier, but the payload need not remain visually hidden forever; visible prose can also contain instructions that are semantically hostile to the model.
The more durable control is to prevent source content from silently becoming trusted policy or inheritable output. A generated document needs machine-readable provenance for every source and model-performed edit, and downstream workflows need to preserve that taint rather than reset trust because the file owner belongs to the organization.
Defensive priorities for Microsoft 365 environments
- Constrain external-document grounding. Do not allow Copilot to retrieve externally shared or newly downloaded files automatically for high-integrity drafting. Require users to select reviewed sources explicitly where the business process permits.
- Inspect representations, not only rendering. Extract document text, styles, metadata, relationships, comments, headers, footers, and embedded objects. Flag low-visibility text and differences between the human-rendered view and the text supplied to AI systems.
- Preserve source and edit provenance. Record which documents grounded an output, which passages came from each source, and what Copilot changed. Keep that lineage attached when a generated document is copied, renamed, or shared.
- Gate consequential use of generated documents. Financial, legal, compliance, safety, and executive reports need deterministic validation and independent approval before their figures or conclusions feed another automated workflow.
- Hunt for propagation indicators. Compare document XML across generations for repeated hidden blocks, unusual JSON-like instructions, tiny or background-matched text, and identical concealed strings appearing in files created by different users.
- Plan containment around carriers. If a suspicious document is found, identify every Copilot session that used it, every output produced from those sessions, and every later workflow that consumed those outputs. Quarantining only the first file is insufficient.
- Keep Copilot and Microsoft 365 controls current. Microsoft says customers should install the latest updates and use multiple security layers. Treat this as exposure reduction, not proof that all reformulations of the class are blocked.
This disclosure extends prompt injection from a compromised answer to a contaminated information lineage. The operational question is no longer only whether Copilot obeyed one malicious document. Defenders must determine which trusted-looking outputs inherited its instructions, where those files traveled, and whether subsequent decisions were grounded in them.
Sources: