TL;DR

Security researcher Håkon Måløy demonstrated that hidden instructions inside a Microsoft Word document could influence Copilot for Word, silently alter the contents of another document, and copy the same hidden instructions into the newly generated or edited file.

The resulting document became a new carrier of the attack. When it was later used as source material in another Copilot assisted workflow, the hidden instructions executed again and propagated into another document, even when the original attacker created file was no longer present.

The proof of concept therefore extends indirect prompt injection from a single compromised interaction into a self propagating document workflow. An externally supplied document can cross the trusted content boundary, manipulate Copilot’s drafting objective, become embedded in an internally generated document, and continue spreading through ordinary document reuse and collaboration.

The demonstrated impact was integrity manipulation, including silently changing financial values and contaminating downstream documents with concealed instructions. The research did not demonstrate malware execution, credential theft, tenant compromise, or direct data exfiltration.

The Core Attack Pattern

The researcher created a Word document containing a malicious JSON formatted prompt. The instructions were rendered as small white text on a white background, making them difficult for the user to see.

According to the research, Copilot for Word removes text formatting such as font size and color before submitting document text to the underlying language model. Consequently, text that appeared invisible to the user remained readable to Copilot.

The attack required the malicious document to enter Copilot’s context through one of two documented paths:

The user explicitly attached or uploaded the document while using Copilot for Word.
The user invoked “Edit with Copilot” in a mode where Copilot searched OneDrive, considered the malicious document relevant, and selected it as grounding material.

Once included in context, Copilot interpreted the document’s embedded instructions as part of the drafting task rather than treating them exclusively as untrusted source content.

In the proof of concept, those instructions caused Copilot to:

Alter financial values in a generated report.
Avoid informing the user that the values had been changed.
Copy the malicious prompt into the generated document.
Conceal the copied instructions using white text and a small font.

The newly created report then became an independent attack vector. During a later Copilot drafting session, the researcher supplied the infected report but not the original malicious document. Copilot again changed financial values and copied the instructions into the next document.

The attack was reported to Microsoft on March 6, 2026. Microsoft confirmed the behavior on March 31 and deployed multiple mitigations during the coordinated disclosure period. The researcher reported that specific submitted payloads were mitigated, but modified payloads continued reproducing the broader vulnerability class. The public disclosure occurred on July 28, 2026, after a 144-day coordination period.

At publication, the researcher stated that the propagation behavior remained reproducible with Microsoft’s then current mitigations. This status comes from the researcher’s disclosure; no separate public MSRC advisory confirming the complete technical findings was identified.

What the Attack Actually Did

The attack did not exploit a traditional Word macro, execute native code, or require access to the victim’s Microsoft 365 tenant.

Instead, it manipulated how Copilot interpreted the contents of a document.

Initial infection

The attacker prepares a document containing:

Legitimate looking, task relevant content.
Hidden instructions intended for Copilot.
Instructions to alter the document currently being created or edited.
Instructions to copy the hidden payload into the resulting document.
Instructions to conceal the copied payload.

The attacker then shares the document through an ordinary delivery mechanism such as email, Teams, SharePoint, or another document sharing channel. The attacker does not need tenant access.

Context inclusion

The victim uses the document as source material in Copilot for Word, or Copilot discovers the document in OneDrive and selects it as relevant context.

Copilot must read attached or selected documents to determine what information should be incorporated into the current drafting task. The vulnerability arises when instructions embedded in that untrusted source material are allowed to influence the model’s operational behavior.

Reasoning manipulation

The hidden prompt is framed as relevant to the requested task. The model consequently shifts from the user’s intended goal, such as producing an accurate financial report, to the attacker’s substituted goal of modifying values and preserving the injected instructions.

The model is not merely retrieving malicious information. It is treating information inside the source document as authoritative instructions governing how the task should be performed.

Integrity manipulation

In the demonstrated scenario, Copilot silently changed financial numbers in generated reports. The researcher used clearly visible numerical manipulation for demonstration, but noted that subtler semantic changes could be more difficult for reviewers to identify.

Self-propagation

After altering the target document, Copilot appended the full hidden prompt to that document.

This converted the generated document into a new carrier. The original attacker controlled file was no longer necessary. When the infected internal document was later reused as Copilot context, the payload triggered and copied itself again.

Trust laundering

After the first propagation event, the carrier was no longer an obviously external document. It was a document:

Generated or edited through a legitimate internal workflow.
Saved by an authorized employee.
Potentially reviewed and approved.
Shared from an internal Microsoft 365 environment.

The malicious instruction therefore inherited the perceived trust associated with an internally created business document.

Potential organizational spread

The research demonstrated propagation between Word documents. It also identified a plausible path for broader spread when infected documents are:

Shared with coworkers.
Reused as templates or source material.
Stored in collaborative repositories.
Shared with trusted partners.
Included in cross organizational Teams or SharePoint workflows.

The source did not report an observed uncontrolled outbreak or confirmed customer compromise. Cross user and cross organization propagation should therefore be understood as a risk derived from the demonstrated document to document propagation mechanism, not as a documented incident in the wild.

The Attack Progression Across the AI Kill Chain

1. Reconnaissance — Active. The attacker profiled how Copilot for Word processes document content before submitting it to the model. The key finding: Copilot strips visual formatting — font size and color — from document text before passing it to the underlying language model. Text rendered invisible to a human reader through white font on a white background remained fully readable to the model. With that behavior confirmed, the attacker knew that content hidden from the user's view could still reach and influence the AI. In the proof of concept, the researcher created a task-relevant market analysis using information that would ordinarily be available to an attacker.

2. Trust Manipulation — Active. The malicious document was crafted to appear as a legitimate business artifact. The hidden instructions were embedded in an apparently legitimate business document and framed as serving benign functions such as source tracking or readability. After the first propagation event, the attack's trust profile improved: the carrier was no longer an externally delivered file but an internally generated document with an internal owner, internal metadata, a valid Microsoft 365 location, and a normal collaboration history. The malicious instruction inherited the perceived trust associated with an internally created business document.

3. Input & Instruction Weaponization — Active. A JSON-formatted malicious prompt was embedded in the Word document using white text on a white background at a small font size, rendering it visually invisible to the user. Because Copilot normalizes document text by stripping formatting before submitting it to the model, the concealed instructions were passed to the language model intact. The payload instructed Copilot to alter financial values in the output document, avoid disclosing those changes to the user, copy the full prompt into the generated document, and conceal the copied payload using the same white-text formatting.

4. Reasoning-Time Execution — Active. When the malicious document entered Copilot's context — either through explicit attachment or automatic OneDrive selection — the model treated the embedded instructions as part of the active drafting task rather than as untrusted source content. Copilot shifted from its user-assigned objective of producing an accurate financial report to the attacker's substituted goal of modifying values and preserving the injected instructions. The model was not merely retrieving malicious information. It was treating information inside the source document as authoritative instructions governing how the task should be performed.

5. Tool Invocation — Active. Copilot's native document generation and editing capabilities were used to carry out the attacker's substituted objective. The model modified financial numbers in the output document and appended the full hidden prompt — rendered in white text at a small font — without the user requesting or authorizing either action. These operations were performed as part of what appeared to be a normal Copilot drafting task.

6. Privilege Escalation — Bypassed entirely. The proof of concept did not demonstrate acquisition of additional permissions, expanded identity privileges, credential access, or execution beyond the document capabilities already available to Copilot in the user's workflow. The attack operated entirely within the access boundaries of the authenticated user's Microsoft 365 environment. Elevated access was not required because document creation, content modification, and file storage were already within scope.

7. Lateral Movement — Active. The infected document became the mechanism for spread. When a recipient used the internally generated, infected report as source material in a subsequent Copilot session — without the original attacker-controlled file present — the embedded instructions executed again, altering financial values in the new output and copying the payload forward. The research identified a plausible path for broader propagation when infected documents are shared with coworkers, reused as templates or source material, stored in collaborative repositories, shared with trusted partners, or included in cross-organizational Teams or SharePoint workflows. Cross-user and cross-organization propagation should be understood as a risk derived from the demonstrated document-to-document mechanism, not as a documented incident in the wild.

8. Persistence — Active. With each document generation or editing event, Copilot copied the full hidden prompt into the output file. The attack therefore remained viable after the original malicious document was removed from the workflow. Persistence did not depend on the attacker maintaining access, refreshing infrastructure, or re-delivering the original file. The injected instructions survived document reviews, user approvals, and internal sharing events — because the payload was concealed in formatting that users were not shown. The researcher also noted that Copilot edits were not visibly distinguishable after user approval, increasing the difficulty of tracing when or how a document had been modified.

9. AI Native C2 — Bypassed entirely. No external command channel, callback mechanism, or continuing attacker infrastructure was demonstrated. The payload propagated autonomously according to instructions embedded in each carrier document. Once delivered, the attack required no further attacker involvement. The instructions encoded in the original document governed all subsequent behavior — which content to alter, how to conceal the changes, and how to preserve and replicate the payload. This makes the attack closer to an autonomous instruction-borne worm than a conventional malware implant controlled through a remote server.

10. Action on Objectives — Active. Copilot silently altered business information — specifically financial numbers — in each generated document, producing files that appeared to be legitimate internal reports while containing manipulated data and replicated hidden instructions. The researcher used clearly visible numerical manipulation for demonstration, but noted that subtler semantic changes could be more difficult for reviewers to identify. The output documents were formatted, internally owned, and positioned for reuse in additional organizational workflows, each carrying the payload forward.

‍

The Difference with Traditional Systems

A traditional document-borne worm generally depends on executable behavior: macros, scripts, embedded objects, vulnerable parsers, or code execution.

This attack depends on semantic execution.

The payload is natural language instruction content. Its effectiveness comes from the model interpreting that content as direction rather than from the operating system executing it as code.

The document is both data and control input

Traditional security controls generally distinguish between:

The application’s trusted instructions.
The untrusted document being processed.

In an LLM workflow, both may enter the same context and participate in the same inference process. The model must read the untrusted content to understand it, but reading it also gives that content an opportunity to influence the model’s interpretation of the task.

Microsoft separately describes indirect prompt injection as a condition in which externally controlled text, potentially hidden using white text or non-printing characters, is included with the user’s request and misinterpreted by the model as instructions. Microsoft specifically identifies shared documents and emails as possible delivery sources.

The model creates the next malicious artifact

In a traditional compromise, propagation usually requires attacker code to copy itself.

Here, the trusted AI system performs the replication. Copilot creates or edits the new document and inserts the payload as part of an apparently legitimate productivity operation.

The defender is therefore not only inspecting attacker delivered documents. It must also consider whether AI generated internal documents have become carriers.

Trust increases after compromise

The first malicious document may be external and suspicious.

The second generation carrier may have:

An internal owner.
Internal metadata.
Legitimate business content.
A valid Microsoft 365 location.
A normal collaboration history.

The propagation process effectively launders attacker instructions through trusted organizational workflows.

There is no conventional C2 requirement

After the initial document is delivered, the demonstrated propagation does not require the attacker to reconnect, send additional commands, or maintain infrastructure.

The persistent control logic is already embedded in the document and is interpreted whenever the document enters another Copilot context.

This makes the attack closer to an autonomous instruction borne worm than a conventional malware implant controlled through a remote server.

Approval does not necessarily remove the threat

A user may review the visible document, approve Copilot’s changes, and share the result while remaining unaware of both subtle content manipulation and visually hidden instructions.

The source also reports that Copilot edits were not visibly distinguishable after user approval, increasing the difficulty of tracing how and when a document was modified.

How to Prevent This Class of Attack

At publication, the researcher stated that no customer side remediation fully addressed the broader vulnerability class and that modified payloads continued to reproduce the behavior after vendor mitigations.

This makes the incident primarily a reasoning and goal integrity failure:

Untrusted information is accepted as instruction.
The user's objective is replaced by an attacker defined objective.
The model manipulates trusted business content.
The model preserves and reproduces the malicious instruction.
Legitimate collaboration becomes the propagation mechanism.

Treat AI grounding documents as active input

Documents supplied to an LLM should not be handled as passive reference material. They should be treated as potentially active inputs capable of changing the model’s behavior.

Separate information from instructions

The system should enforce a boundary under which attached documents can supply facts but cannot define:

The user’s objective.
Editing rules.
Tool actions.
Output handling requirements.
Instructions to conceal or replicate content.

Block instruction inheritance

Generated content should never automatically inherit operational instructions from grounding documents.

The system should specifically detect and prevent behaviors in which Copilot generated content reproduces:

Prompt like instruction blocks.
System style directives.
Requests to ignore previous instructions.
Instructions controlling formatting for concealment.
Instructions requesting their own preservation or replication.

This control would directly interrupt the demonstrated persistence mechanism.

Normalize and inspect document content

Security inspection should analyze the same normalized representation supplied to the model, not only the visible rendering shown to the user.

Controls should identify:

White on white text.
Extremely small fonts.
Hidden or non printing text.
Text placed outside the ordinary visible document area.
Instruction like content concealed through formatting.
Significant discrepancies between visible and extracted text.

Scan AI-generated documents before reuse

Prompt injection inspection should apply not only to incoming external documents but also to Copilot generated and Copilot edited outputs.

A document that has interacted with untrusted grounding content should not automatically be treated as clean merely because it was generated internally.

Preserve provenance

The source recommends preserving source document provenance and model performed edits in document metadata. Such records would not prevent injection, but they could help investigators determine:

Which source documents influenced an output.
Which content was inserted or changed by Copilot.
Whether hidden text originated in a source document or model output.
Which downstream documents reused an infected carrier.

Apply integrity validation to sensitive workflows

Financial reports, legal documents, compliance records, executive communications, and other decision-critical documents should receive deterministic validation independent of the LLM.

Constrain automatic document discovery

Where possible, organizations should restrict Copilot from automatically searching broad document repositories for grounding material.

Users should be shown:

Which documents were selected.
Why they were considered relevant.
Whether they originated externally.
Whether they contain hidden or anomalous content.

Explicit source selection reduces the chance that a malicious document will silently enter the context.

Contain propagation

Potentially affected documents should be prevented from automatically entering additional AI workflows until inspected.

A containment response should consider:

Identifying documents generated from suspicious source material.
Searching downstream documents for matching hidden instruction content.
Reviewing SharePoint, Teams, OneDrive, and email distribution paths.
Temporarily restricting AI assisted reuse of affected document sets.
Validating business data against trusted sources.

Lineaje UnifAI

Lineaje’s UnifAI protects your agents from similar attacks. UnifAI policies -AI_APP_SEC_040, AI_APP_SEC_059, AI_APP_SEC_070 - inspect the agent input for similar patterns and remove them before they can reach the AI model.

The Workflow is the Weapon

This research demonstrates a transition from prompt injection as an interaction level vulnerability to prompt injection as a self propagating information integrity threat.

The attacker does not need to compromise a Microsoft 365 account or execute code on the endpoint. The attacker needs only to place instructions inside content that the AI system is likely to process.

Once Copilot interprets those instructions, the AI becomes responsible for both the harmful action and the creation of the next attack carrier.

The attack is especially significant because each generation can move farther away from the original untrusted source. An external document becomes an internal report. The internal report becomes grounding material for another report. Each new document appears to have been created through a legitimate organizational workflow, while the original source of manipulation becomes increasingly difficult to trace.