Copilot Prompt Injection Can Rewrite Docs, Self-Propagate
Hidden instructions in Word docs can make M365 Copilot falsify figures and embed the attack in output files, which then fire again in the next Copilot session. No patch announced.
Marisol "Fuse" Delgado Researcher Håkon Måløy disclosed on July 28 that hidden instructions embedded in a Word document can cause Microsoft 365 Copilot to do two things: alter numeric figures in whatever report it drafts from that document, and copy those same instructions verbatim into the output file.
The second part is what makes this more than a one-time manipulation. The output document becomes a carrier. Feed it into a second Copilot drafting session and the hidden instructions fire again. Måløy’s proof-of-concept demonstrated exactly that: the internally generated file triggered the same behavior in a subsequent session without any further access to the original poisoned source.
He reported the issue to Microsoft 144 days before making it public. The Hacker News covered the disclosure on July 30.
What changed
This is a prompt injection attack against Copilot for Word. The attacker embeds instructions in a Word document — a contract, an RFP, a vendor-supplied template, anything a user might hand to Copilot for summarization or redrafting. Copilot processes the document, follows the hidden directives, and produces output with altered content. The injected instructions then travel with the output.
The threat model here isn’t a direct compromise of Microsoft’s infrastructure. It’s document-chain manipulation: a malicious supplier, a phished partner, or even an attacker with brief access to shared document storage can introduce a carrier file into a workflow that uses Copilot. Every downstream Copilot session that touches that file — or any file Copilot generated from it — is potentially affected.
What to do
-
Treat external documents as untrusted before Copilot processes them. Files from vendors, partners, or any source outside your organization should not be fed to Copilot without a human review of the raw content first. Hidden instructions can survive standard previewing — the review needs to check for unusual formatting, invisible text, or unexpected XML in the document.
-
Don’t accept Copilot-generated figures without source verification. This research makes concrete what should already be practice: numbers that Copilot summarized or redrafted need to be checked against the original data, not accepted because they appeared in the AI output.
-
Audit document circulation workflows. Copilot-generated files that get shared widely inside an organization carry the propagation risk. If a document originated from Copilot processing an untrusted source, any downstream Copilot session that uses it inherits that risk.
-
Review Copilot permissions on shared document libraries. The broader the set of documents Copilot can access when drafting, the broader the potential propagation surface if a carrier file lands in a shared location.
Current status
No CVE has been assigned. Microsoft received Måløy’s report 144 days before the July 28 disclosure; as of publication there is no public patch, advisory, or acknowledgment tied to this specific research. Until Microsoft addresses the prompt injection surface in Copilot for Word, the controls are process-level: know what documents Copilot is working from, and do not treat AI-generated content as authoritative on figures that haven’t been verified against source data.
Copilot for Word is deployed across enterprise Microsoft 365 tenants. If your organization uses it for financial reporting, contract review, or any workflow where document figures matter, this is not a theoretical risk to schedule for next quarter.
Sources: The Hacker News. Related: Copilot Workflow Jailbreak via Shared Files, AI Agents as Attacker and Auditor.
Found this useful? Share it.
