- Hidden instructions in Word documents can make Microsoft 365 Copilot rewrite financial figures and copy the same payload into the finished file, according to researcher Håkon Måløy.
- Microsoft deployed two mitigations after Måløy’s report, but the attack class remained exploitable on July 28, 2026, the day of disclosure.
- The technique requires a Copilot drafting or editing operation and the malicious document must enter the model’s context as an attachment or OneDrive source.
Researcher Håkon Måløy disclosed on July 28, 2026, that hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report and then copy the same instructions into the finished file, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when used in a second Copilot drafting session.
Microsoft confirmed the behavior on March 31 and deployed two mitigations: the first blocked the original prompt wording, and the second upgraded the underlying model to GPT-5.5. However, Måløy said the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. “The vulnerability class therefore remains exploitable at the time of publication,” Måløy said.
The attack is not zero-click and does not execute conventional malware. It requires a Copilot drafting or editing operation, and the malicious document must enter the model’s context as an attachment or as a OneDrive source selected by Work IQ, the intelligence engine behind Microsoft 365 Copilot. The disclosure does not report exploitation in the wild, and Måløy withheld the complete payload.
He recommends treating external documents as untrusted, reviewing attached documents before starting a generation or edit, and checking Copilot-generated files before reuse or sharing. The chain runs through document text and Copilot’s own drafting behavior: Copilot reads source files to decide what belongs in a draft and can mistake instructions inside them for part of the user’s request.
In the proof of concept, Copilot halved every financial figure, copied the full prompt into the output in white, eight-point text, and disclosed neither change. Måløy said Word strips colour and font size before sending document text to the large language model, leaving white-on-white instructions legible to the model. One part of the payload altered the document; the other told Copilot to copy and conceal the instructions, framing those commands as source-tracking and readability requirements.
Microsoft says Word can ground a draft on up to 20 files, emails, or meetings, and Edit with Copilot can use Work IQ. In Måløy’s test, Copilot searched OneDrive for a quarterly report, found the malicious market analysis outside the folder containing the other sources, and included it. With the original malicious document absent and only the infected Q1 report attached, Copilot halved the figures in a Q2 draft and appended the prompt again.
The new carrier was an ordinary internally generated document. The chain does not propagate on its own: each hop requires another Copilot drafting or editing operation in which the carrier enters the model’s context. Måløy argues that the break in the provenance trail makes the manipulation harder to trace. As of publication, no public CVE or standalone Microsoft advisory for the Word finding exists in searches of NVD, CVE.org, and Microsoft’s Security Update Guide.
Microsoft says jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts, although they may not be available in every Copilot scenario. Defender for Office 365 adds mail-flow inspection for inbound email. Neither Microsoft nor Måløy says whether this exact payload is detected at either layer. Microsoft made a related point in a June post about AI memory, writing that “Prompting alone is not a reliable security boundary” and that memory access and isolation should be controlled by deterministic systems rather than model instructions.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
