A security researcher has disclosed a vulnerability in Microsoft Copilot for Word that could allow hidden malicious instructions to replicate through documents used in everyday collaboration. The technique uses prompt injection rather than conventional malware, creating a risk for organizations using Copilot to draft, edit, or summarize Word files.
The issue was reported to Microsoft by security researcher Håkon Måløy in March 2026 and followed a 144-day coordinated disclosure process. Microsoft has implemented partial mitigations, although the broader attack class remained effective as of late July 2026.
The disclosure matters because Word documents routinely travel through email, SharePoint, Teams, and OneDrive. A document that appears legitimate to an employee could potentially influence Copilot’s behavior when it is used as reference material, allowing the threat to move through normal workflows.
How the Hidden-Prompt Technique Works
The attack begins with a Word document containing text formatted in white on a white background. The content is effectively invisible during a normal read-through, allowing an attacker to conceal instructions without changing the document’s apparent purpose or presentation.
Those instructions can be structured as a prompt intended for Copilot rather than as content for the user to read. When someone asks Copilot for Word to create, revise, or summarize content based on the document, the AI can process the concealed text alongside the visible material. Copilot may then interpret the hidden content as an instruction.
But it doesn’t end there. As Radoslav Krehlik, owner at NORAM spol., explains,
“the processcreates a self-propagating AI worm that spreads through normal collaboration in SharePoint, Teams, OneDrive, and email.”
Once the new document is shared and used by another employee as Copilot source material, the process can happen again, creating further carrier files without relying on macros, executable code, or a traditional malware payload. This can make the activity difficult to trace.
As the disclosure summary states: “No special access is required. Simply opening or referencing the poisoned document is enough.” That makes the threat relevant to organizations where employees regularly reuse documents, templates, and externally supplied material.
What Organizations Can Do to Reduce Exposure
The most immediate defensive measure is to treat externally sourced documents as untrusted before using them with Copilot for Word. That includes files received by email, downloaded from websites, shared by partners, or supplied during procurement, legal, and customer service processes.
Security teams should ensure that users understand the distinction between opening a document and asking an AI assistant to act on its contents. Copilot’s ability to use a document as context can introduce a separate layer of risk, particularly if the file has not been reviewed through established security controls.
Organizations should also ask users to verify documents generated or edited by Copilot before sharing them. The risk is not limited to the original malicious file. An apparently legitimate document produced by an employee may have become a carrier for hidden instructions.
For businesses that do not need Copilot in Word for all users, reducing its availability may be appropriate while internal risk assessments are carried out. Individual users can disable Copilot through Word settings, while Microsoft 365 administrators can control how prominently Copilot Chat is surfaced across Microsoft 365 apps.
Disabling optional connected experiences can also limit certain cloud-enabled functionality. These settings do not eliminate prompt injection risks, but they can reduce the likelihood that an unvetted document will be processed by Copilot as part of a routine workflow.
Copilot’s Connected Data Model Creates Both Value and Risk
Microsoft’s broader Copilot strategy is built around connectedness. The assistant is designed to work across a user’s workflow, bringing together information from documents, communications, meetings, and business systems to reduce manual searching and context switching.
For enterprises, that is a central benefit. A Copilot capable of drawing on organizational knowledge can make employees more productive, help teams locate relevant information, and accelerate work that would otherwise require moving between multiple applications.
However, the same capability is proving to create a security challenge. If untrusted content is presented in the same context as a user’s request, an AI system must reliably distinguish data it should analyze from instructions it should follow. The Word vulnerability suggests that this distinction can break down.
It is not the first recent example of researchers identifying risks associated with Copilot’s cross-platform access. Last month, security researchers at Varonis disclosed a vulnerability that could enable information extraction from connected Microsoft 365 environments.
The attack chain constructed by Varonis combined three weaknesses, each intended to bypass a separate safeguard built into Copilot. The first was a Parameter-to-Prompt Injection, in which a malicious instruction was embedded in a URL query parameter rather than an email or document.
An attacker could craft a link to Microsoft 365 Copilot’s search function containing a command to search a user’s emails and extract sensitive material. According to the researchers, Copilot complied with the instruction, underlining the difficulty of separating trusted intent from attacker-controlled context.
Prompt Injection Will Remain an Enterprise Governance Issue
The Copilot for Word disclosure does not mean that organizations must abandon AI-assisted productivity tools. It does mean that AI adoption requires security controls that account for how models process documents, links, and data from across the organization.
Traditional security practices remain relevant, including cautious handling of external files, user awareness training, access controls, and document review procedures. But enterprises may need to extend these practices to cover the point at which content is supplied to an AI assistant.
Microsoft’s mitigations may narrow specific attack routes, but the underlying prompt injection challenge is broader than any single product update. Large language models still face fundamental difficulties when trusted instructions and attacker-controlled material share the same working context.
The immediate priority for IT and security leaders is to understand where Copilot is being used to process external content and what safeguards apply before that content enters the workflow. High-risk functions, including legal, finance, HR, and customer operations, may need more prescriptive rules.
As Copilot becomes more integrated across Microsoft 365, enterprises will need to view AI context as part of the security perimeter. The value of connected knowledge remains significant, but this incident shows that the controls governing what Copilot can read, trust, and act on will be just as important as the assistant’s capabilities.
