Copilot for Word Prompt Injection Spreads via Hidden Text

A Copilot for Word prompt injection technique lets an attacker hide instructions in a document as white-on-white text, have Microsoft 365 Copilot silently execute them — such as altering financial figures — and then copy those same hidden instructions into documents Copilot later drafts from it, so the file itself carries the instructions forward. Researcher Håkon Måløy disclosed the technique on July 28, 2026, roughly 144 days after reporting it to Microsoft; there is no CVE, and Måløy showed the attack class still worked after Microsoft's fixes.

The mechanism is a chain of small, reasonable-looking behaviors. Word strips color and font-size formatting before sending a document's text to the language model, so instructions written in white 0.5pt text — invisible to a human — arrive at Copilot as plain, readable text. Copilot, reading the source file to decide what to draft, cannot tell the difference between the user's request and the smuggled commands, so it follows them. When it then writes a new document based on that source, it copies the hidden payload into the output, and the new file becomes infected too. Måløy is careful about the limits: "The chain does not propagate on its own: each hop requires another Copilot drafting or editing operation." It is not zero-click, and it needs the victim to point Copilot at a malicious document via an attachment or OneDrive. Microsoft confirmed the behavior on March 31, 2026 and shipped two mitigations — blocking the original prompt wording and upgrading the model from GPT-5.5 to GPT-5.6 — but Måløy demonstrated the attack still functioned on GPT-5.6 the next day.

Why don't Microsoft's fixes close the hole?

Because they treat a structural problem as a content problem. Blocking one prompt's exact wording and swapping the underlying model are both content-level guardrails, and the security community's consistent point on Hacker News and r/netsec is that these are trivially bypassed by rephrasing the payload — semantic variation defeats a blacklist. The deeper issue is the one LLMs have not solved: they do not separate trusted instructions from untrusted data, so any text in the context window can act as a command. White-on-white text is just one delivery vector; researchers note zero-width characters, invisible Unicode, and metadata fields achieve the same hidden injection. The question defenders keep asking is why the pipeline doesn't detect and discard text that was deliberately styled to be invisible — background-matched font colors, sub-point font sizes — during extraction, so that content flagged as hidden never reaches the model as trusted input in the first place.

What's the realistic attack scenario?

The one that worries enterprises is document poisoning at workflow scale. Send a vendor quote, résumé, or contract with hidden instructions; when an employee asks Copilot to summarize or rewrite it, the instructions silently alter figures or seed the output with more hidden payload. Because the infected output lands on SharePoint or OneDrive, the next person who has Copilot build on it re-triggers the chain — a document "worm" that spreads one Copilot operation at a time across a shared drive.

Our read

This is what an AI agent embedded in daily work looks like as an attack surface: the model is a trusted actor inside your documents, and it will faithfully carry out instructions it can't reliably tell apart from data. Model upgrades and prompt blacklists are weak controls here because they act on wording, not structure — the more durable posture is to treat every external document as untrusted input and to make the workflow verifiable by design, so that what Copilot ingested and produced can be inspected rather than assumed safe. Supervised adversary simulation is the discipline that surfaces a self-propagating prompt-injection chain before it reaches a finance team's Copilot, and the evidence it produces doubles as compliance-as-evidence for how AI-assisted processes are actually controlled — the concrete way a security team can understand this risk instead of trusting an uninspectable model output.

Reporting by The Hacker News; technique and disclosure timeline per researcher Håkon Måløy. Sources linked above.

Related: Azure DevOps MCP flaw hijacks AI review agents · VMware CVE-2026-59309: vCenter auth bypass and VM escape

Frequently asked questions

Is there a CVE for the Copilot for Word prompt injection?
No. As of disclosure on July 28, 2026 no CVE had been assigned and the issue does not appear in the NVD, CVE.org, or Microsoft's Security Update Guide. Microsoft classes it as a behavior it has partially mitigated rather than a tracked vulnerability.

Is this a zero-click attack?
No. It requires a user to have Copilot draft or edit content using a malicious document as a source. Each propagation step also needs a separate Copilot operation — it does not spread on its own.

Did Microsoft's GPT-5.6 upgrade fix it?
No. Microsoft blocked the original prompt wording and moved from GPT-5.5 to GPT-5.6, but the researcher demonstrated the attack class still worked on GPT-5.6 the following day. Rephrased payloads bypass wording-based blocks.

How should organizations defend against it?
Treat all externally sourced documents as untrusted input, review Copilot-generated files before sharing or reusing them, and where possible detect and discard invisibly-styled text before documents enter AI workflows. Rather than assuming model guardrails hold, verify them: test Copilot-driven processes adversarially and keep an inspectable record of what the agent ingested and produced, so the control is evidenced rather than assumed.