Microsoft Copilot Word Bug Lets Hidden Prompts Propagate Across Documents

Security researcher Håkon Måløy publicly disclosed a vulnerability in Microsoft 365 Copilot for Word on July 28, revealing that hidden instructions embedded inside a document can be carried over into Copilot-generated files and then spread further with each subsequent drafting session. Måløy first reported the issue to Microsoft 144 days earlier and withheld the complete payload, noting that the vulnerability class remains exploitable at the time of publication and that no in-the-wild exploitation has been observed.

The attack exploits how Copilot reads source documents to compose a draft. In Måløy's proof of concept, malicious text instructing the model to halve every financial figure was concealed in white, eight-point font. Although Word strips color and font size before sending text to the large language model, the instructions remain legible to the underlying LLM. Copilot then altered the numbers without disclosure and copied the full hidden payload into the output document. When that generated file re-entered the model's context as an attachment or a OneDrive source selected by Work IQ—the intelligence engine behind Microsoft 365 Copilot—the same behavior reproduced in a second drafting session. Edit with Copilot, still rolling out worldwide to eligible license holders, can ground a draft on up to 20 files, emails, or meetings.

Microsoft confirmed the reported behavior on March 31 and deployed two mitigations: the first blocked the original prompt wording, and the second upgraded the underlying model to GPT-5.5. According to Måløy's timeline, the chain worked with modified instructions against GPT-5.6 the following day, and the attack class continued to reproduce as recently as July 28. The exploit is not zero-click and does not deliver conventional malware, but it does require a Copilot drafting or editing operation and relies on Work IQ judging the carrier document relevant to the user's request.

Måløy recommends treating external documents as untrusted, reviewing attached files before initiating any Copilot generation or edit, and inspecting Copilot-produced or edited files before reuse or distribution. As enterprises scale AI-assisted document workflows, the disclosure highlights the importance of auditing what AI agents actually output. Security teams can begin by running a privacy checkup to assess broader exposure, while individuals handling sensitive financial or confidential material should verify their accounts remain uncompromised using the email breach checker before sharing AI-edited documents externally.