Microsoft Copilot for Word Vulnerability Allows Hidden Prompt Injection and Propagation

Security researcher Håkon Måløy disclosed a prompt injection vulnerability in Microsoft 365 Copilot for Word that allows hidden instructions in a document to manipulate AI-generated content and propagate to new files. The technique, reported to Microsoft on March 31, 2026, involves embedding malicious prompts in white, eight-point text that is invisible to users but readable by the AI model. In a proof of concept, Copilot halved financial figures in a quarterly report and copied the hidden instructions into the output, creating a carrier document that could trigger the same behavior in subsequent drafting sessions without the original malicious source. Microsoft deployed two mitigations: blocking the original prompt wording and upgrading the underlying model to GPT-5.5. However, Måløy demonstrated that modified instructions worked on GPT-5.6 the next day, and the attack class remained exploitable as of July 28, 2026. The vulnerability is not zero-click and requires a Copilot drafting or editing operation with the malicious document in the model’s context as an attachment or OneDrive source selected by Work IQ. No exploitation in the wild has been reported, and no CVE or standalone advisory has been issued. Microsoft notes that jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts, and Defender for Office 365 adds mail-flow inspection. Måløy recommends treating external documents as untrusted, reviewing attachments before AI operations, and checking Copilot-generated files before reuse.