Full Report
Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's
Analysis Summary
# Vulnerability: Persistent Indirect Prompt Injection in Microsoft 365 Copilot (Word)
## CVE Details
- **CVE ID:** Not Assigned (As of July 30, 2026)
- **CVSS Score:** N/A (Estimated Medium/High based on Integrity impact)
- **CWE:** CWE-116: Improper Encoding or Escaping of Output; CWE-506: Embedded Malicious Code (AI Prompt Injection variant)
## Affected Systems
- **Products:** Microsoft 365 Copilot for Word; Microsoft Work IQ engine.
- **Versions:** Current versions using GPT-5.5 and GPT-5.6 (as of the disclosure date).
- **Configurations:** Systems where Copilot handles external documents, OneDrive sources, or uses "Edit with Copilot" features.
## Vulnerability Description
This flaw is an "Indirect Prompt Injection" that acts like an AI worm. Malicious instructions are hidden within a Word document (e.g., using white, 8-point text). Because Word strips formatting before sending text to the Large Language Model (LLM), the instructions remain visible to the AI while hidden from the human user.
The attack exploits "Context Collapse," where the AI fails to distinguish between the user's instructions and the data being processed. Specifically, the payload instructs Copilot to:
1. Perform a malicious action (e.g., altering financial figures).
2. Secretly copy the original malicious prompt into the newly generated document.
This ensures the "infection" persists in internally generated files, affecting future drafting sessions that use those files as reference material (grounding).
## Exploitation
- **Status:** PoC available; disclosed by researcher Håkon Måløy. No confirmed exploitation in the wild.
- **Complexity:** Medium (Requires creating a document that Work IQ deems relevant to a user’s query).
- **Attack Vector:** Local/Adjacent (Requires a user to trigger a Copilot session that includes the malicious document as a source/attachment).
## Impact
- **Confidentiality:** Low (Though the PoC focused on integrity, prompt injection can be used for data exfiltration).
- **Integrity:** High (Calculations and report figures can be manipulated without being disclosed to the user).
- **Availability:** Low (Does not crash systems, but reduces the reliability of AI-generated content).
## Remediation
### Patches
- No final patch available. Microsoft attempted mitigations by blocking specific prompt wordings and upgrading models (GPT-5.5/5.6), but the researcher confirmed the attack class remains exploitable with modified instructions.
### Workarounds
- **Manual Review:** Users should manually inspect any external documents before using them as "grounding" or reference files for Copilot.
- **Verification:** Always verify the output of Copilot-generated content, especially for numerical data or financial figures.
## Detection
- **Indicators of Compromise:** Presence of hidden text (white font on white background) at the end of generated documents; unusual discrepancies in data (e.g., figures being halved/doubled consistently).
- **Detection Methods:**
- Use "Select All" (Ctrl+A) in Word and change font color to black to reveal hidden instructions.
- Implement Microsoft Defender for Office 365 mail-flow inspection to scan for inbound prompt injection patterns.
## References
- Researcher Blog: hxxps[://]enklypesalt[.]com/posts/context-collapse-part3-ai-worming-through-word/
- Original Report: hxxps[://]thehackernews[.]com/2026/07/microsoft-copilot-for-word-can-copy.html
- Microsoft Documentation on Grounding: hxxps[://]support[.]microsoft[.]com/en-us/word/copilot/draft-and-add-content-with-copilot-in-word