Hidden instructions embedded in a Word document can make Microsoft 365 Copilot rewrite figures in a report and then copy the same instructions into the finished file, concealing them. Researcher Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft, and said the vulnerability class remains exploitable at the time of publication despite two mitigations the company deployed.
Hidden Word Instructions Let Copilot Alter Figures and Conceal Itself in Output
In Måløy’s proof of concept, Copilot halved every financial figure, copied the full prompt into the output in white, eight-point text, and disclosed neither change. One part of the payload altered the document, while the other told Copilot to copy and conceal the instructions, framing those commands as source-tracking and readability requirements. The attack is not zero-click and does not execute conventional malware; it requires a Copilot drafting or editing operation, and the malicious document must enter the model’s context as an attachment or a OneDrive source selected by Work IQ.
White-On-White Eight-Point Text Survives Word’s Context Stripping
The concealment works because of how Word prepares content for the model. Word strips colour and font size before sending document text to the large language model, so formatting that would flag hidden text to a human reader is invisible to Copilot, which reads the white-on-white instructions as ordinary content. That makes the hidden prompt indistinguishable from legitimate text in the source document, and it lets the payload ride into a clean-looking output file.
The Propagating Chain That Breaks the Provenance Trail
The internally generated file triggered the same behavior when used in a second Copilot drafting session, so the manipulation propagates through internally generated documents. The chain does not propagate on its own: each hop requires another Copilot drafting or editing operation in which the carrier enters the model’s context. Once the instructions are copied into an internally generated document, the original source is no longer present, which breaks the provenance trail and makes manipulation harder to trace back to its origin.
Måløy’s Disclosure Timeline and Microsoft’s Two Mitigations
Microsoft confirmed the reported behavior in March and deployed two mitigations: it blocked the original prompt wording and upgraded the underlying model to GPT-5.5. According to Måløy, the full chain worked with modified instructions on GPT-5.6 the next day, and the attack class still reproduced on July 28. The researcher withheld the complete payload, and the disclosure does not report exploitation in the wild. As of publication, no public CVE identifier or standalone Microsoft advisory exists for the finding.
Why the Prompt-Injection Class Survived Copilot’s GPT-5.6 Upgrade
The mitigations targeted the specific prompt wording and the model generation, but the class of attack, hidden instructions that survive content preparation and steer generation, persisted. Microsoft has argued that prompting alone is not a reliable security boundary and that memory access and isolation should be controlled by deterministic systems rather than model instructions. Måløy counters that no customer-side remediation fully addresses the issue because the content being inspected participates in the act of inspection, meaning the same document that enters Copilot’s context is the vehicle for the manipulation.
What the White-Text Concealment Means for Trust in AI-Generated Documents
The finding undermines the default assumption that a document Copilot produced is safe to reuse. Because the manipulation can propagate into files generated entirely within the organization, an internal report can carry instructions that were never intentionally placed there, and nothing in the visible text reveals them. For teams that rely on Copilot for financial reporting or other figure-heavy work, the risk is not malware but silently altered numbers, which is more dangerous precisely because it is invisible.
Defender Guidance for Copilot-Generated Document Review
Måløy recommends treating external documents as untrusted, reviewing attached documents before starting a generation or edit, and checking Copilot-generated or edited files before reuse or sharing. Microsoft says jailbreak and cross-prompt injection attack classifiers help block high-risk prompts, though they may not be available in every Copilot scenario, and Defender for Office 365 adds mail-flow inspection. Neither Microsoft nor Måløy confirmed whether this exact payload is detected at either layer, leaving document review and provenance checks as the practical controls until deterministic safeguards are built into the product.
