Copilot for Word copied hidden prompts into documents

On 30 July 2026, new reporting described an attack class affecting Microsoft 365 Copilot in Word. A hidden instruction inside a source document could change figures in a generated report and copy itself into the new file. When that internally generated carrier was later used in another Copilot session, the behaviour repeated.

This was not a self-propagating worm or conventional malware. Every hop required a Copilot drafting or editing operation and inclusion of the carrier in the model’s context. The research nevertheless exposes an important trust boundary: a document generated inside an organisation can inherit instructions from an external source while looking internal and trustworthy.

The confirmed findings

Researcher Håkon Måløy published “AI Worming through Word” on 28 July. Reporting published on 30 July clarified the disclosure status and tested scope:

• the malicious document had to enter Copilot’s context as an attachment or a OneDrive source selected through Work IQ;
• the instruction altered numerical values and told Copilot to copy the instruction into its output;
• the copied prompt was concealed as white, eight-point text;
• the internally generated file carried the behaviour into another session;
• each hop required another drafting or editing action with the carrier in context;
• no exploitation against customers was reported;
• the full payload was withheld;
• no public CVE or standalone Microsoft advisory covered the finding at publication time.

According to the researcher’s timeline, Microsoft confirmed the report on 31 March and deployed two mitigations: blocking the original prompt wording and changing the underlying model. Måløy said modified instructions reproduced on a subsequent model and that the class still worked on 28 July. That is the researcher’s account; Microsoft has not published a separate notice confirming every retest result.

How a document became an instruction carrier

Copilot is expected to follow the user’s request while reading files used as reference material. The model must distinguish content to analyse from content attempting to control its behaviour. The attack deliberately collapsed that distinction.

The instruction was written as white text on a white background. A person viewing the document would not see it, but Word removed colour and font-size information when preparing text for the large language model. The content therefore remained readable to Copilot. White text is only one delivery method, not the root problem. Comments, metadata, off-canvas elements, OCR text and connected-system data can present the same trust challenge.

The payload performed two jobs. First, it altered business content: the proof of concept halved every financial figure. Second, it directed Copilot to copy and conceal the instruction in the generated file. Copilot disclosed neither operation.

The new file resembled an ordinary organisation-created document. When it entered the next session, the original external document was absent. This is provenance collapse: the output preserves influence from an untrusted source but loses the readily visible link to that source.

Why “AI worm” needs a qualification

A conventional worm launches new copies and spreads without a repeated user decision. This chain did not. It required:

1. a drafting or editing action;
2. a carrier document in context;
3. saving the output;
4. using that output as a source for another action.

The demonstration is not evidence of autonomous movement across tenants, inboxes or endpoints. Instruction propagation through intermediate documents is the more precise description.

The worm analogy still highlights accumulated trust. Each recipient may consider an internal report safer than a supplier file. Organisations may also route generated content automatically into SharePoint, Teams or approval workflows, extending the potential impact of an unreviewed carrier.

Work IQ expands the context surface

Microsoft says Word drafting can ground on up to 20 files, emails or meetings. Edit with Copilot can use Work IQ to discover relevant material.

In the research, the system selected a market-analysis document in OneDrive outside the folder containing the other sources. Work IQ still had to judge that file relevant. There is no evidence that every OneDrive document automatically enters every prompt. The important point is that users may not know the full source set selected by the agent.

Broader retrieval improves usefulness while increasing the indirect prompt-injection surface. A safer interface should show every source before action, display its trust level and preserve exact provenance for passages used in the result.

Why blocking one phrase does not close the class

A filter can detect a known string or prompt structure. An attacker can change language, order, encoding and narrative. The model still has to read potentially adversarial content in order to classify it.

Microsoft has made the related point that prompting alone is not a reliable security boundary for AI memory. Access, isolation and persistence require deterministic controls. For document workflows, those controls include:

• source and tenant labels;
• policies governing external data in generation;
• reduced model capability when context is untrusted;
• separate approval before numerical or decision changes;
• a visible source manifest attached to outputs;
• prevention of concealed control-instruction copying;
• operation logs available to security teams.

Prompt-injection classifiers remain useful, but they should not independently determine whether a model can change a financial report or distribute a result.

Business impact without code execution

The demonstration did not execute operating-system commands. That does not make its impact trivial. Organisations use documents to approve budgets, forecasts, offers, risk decisions, contracts and executive communications. A silent numerical change can cause harm without a traditionally “compromised” computer.

Threat scenarios include:

• altered metrics and report recommendations;
• removal of warnings or insertion of false conclusions;
• instruction movement into a trusted document workflow;
• disclosure of data from other context sources;
• loss of the original manipulation’s provenance;
• contamination of templates and repeatedly reused materials.

Not every scenario was demonstrated. They are threat-model consequences of proven modification and instruction copying, not claims about observed incidents.

Assessing organisational exposure

Start by inventorying licences and functions: who can use Draft with Copilot, Edit with Copilot and Work IQ, and which repositories are searched. Then identify business processes that allow generated documents to move forward without manual review.

Review:

• documents produced from customer and supplier material;
• financial and executive reports;
• files selected automatically by Copilot;
• unusual formatting, hidden text or off-canvas elements;
• numerical differences between source and output;
• outputs shared more broadly than their source material;
• AI-generated documents reused as templates.

The absence of a known prompt string does not establish safety. Do not remove every white-text element indiscriminately either; legitimate layouts can contain it. Detection needs provenance, usage context and content-difference evidence.

A practical control plan

1. Treat external documents as untrusted data. This remains true after a file is stored in corporate OneDrive.
2. Show users the source manifest. They should see what Work IQ selected before generation.
3. Verify figures and decisions. Compare critical values with a system of record, not merely another document.
4. Separate contexts. Customer data should not mix unnecessarily with finance, HR and board repositories.
5. Restrict automatic publication. AI output should not enter approval flows without review.
6. Preserve provenance. Log source identifiers, versions and execution times.
7. Exercise an AI-injection incident. Response must recall derivative documents, not only the original file.

Organisations adopting Microsoft 365 Copilot should incorporate these controls into secure AI implementation and AI red teaming. Testing model answers alone is insufficient; repositories, permissions, document workflows and logging all matter.

Detection and response

When a suspicious document is identified, establish its origin, derivative versions, users and Copilot sessions. Quarantining one file may be insufficient if its content has already entered reports, presentations or messages.

A response procedure should include:

• preserving the original and version history;
• comparing visible content with extracted text;
• enumerating documents generated from the source;
• checking changed figures, names, addresses and recommendations;
• restricting further sharing;
• regenerating outputs from clean, explicitly selected sources;
• notifying business-process owners as well as the SOC.

We explore the underlying class in our in-depth prompt-injection guide and AI incident-response playbook. Organisational cybersecurity training should teach that “generated by corporate Copilot” does not mean “verified.”

Reproducing the class safely

A controlled test should never use production documents or real business data. Create an isolated tenant or test library, one clearly labelled source document and a harmless instruction that changes only a unique canary value. Run summarisation, editing and document creation separately while recording source identifiers, output and version history. Then use the generated document as input to a second operation and determine whether the influence crossed that boundary.

A positive result does not require code execution. It is enough for an instruction hidden from the reviewer to change a value reproducibly or appear in a derivative document. Include a clean negative-control file and a run with explicitly selected sources. Those comparisons help distinguish context-boundary failure from ordinary model hallucination. Do not test outbound data-transfer instructions, and never place a contaminated output in repositories indexed by production assistants.

Source findings versus Breachroad conclusions

The sources confirm numerical alteration, concealed prompt copying, reproduction through an intermediate document, the need for an active Copilot operation and the absence of public in-the-wild exploitation. Mitigation and retest status comes from the researcher rather than a standalone vendor advisory.

Our source-manifest, repository-separation, approval and derivative-document tracking recommendations are Breachroad conclusions intended to reduce the whole class, not one payload.

The central lesson is that an AI system cannot grant trust to its own outputs. An internal document can still carry influence from an untrusted source. Teams can build safe foundations for working with agents and data through the Breachroad Academy.