# AI 'Worming' Through Word: Hidden Instructions Manipulate Microsoft 365 Copilot  A novel technique has been uncovered where hidden instructions within a **Microsoft Word** document can compel **Microsoft 365 Copilot** to alter figures in a report and then propagate these same instructions into the generated file. Security researcher **Håkon Måløy** publicly disclosed this method on July 28, 144 days after initially reporting it to **Microsoft**. ## The Mechanism of Manipulation **Måløy's** proof of concept demonstrates a concerning chain reaction: a file internally generated by **Copilot** with these hidden instructions subsequently triggered the same behavior when used in a second drafting session. This indicates a potential for the malicious directives to persist and spread within an organization's document ecosystem. According to **Måløy's** timeline, **Microsoft** acknowledged the reported behavior on March 31 and implemented two mitigations. The first aimed to block the original prompt wording, while the second involved upgrading the underlying model to **GPT-5.5**. However, **Måløy** found that the full attack chain remained effective with modified instructions on **GPT-5.6** the very next day, and the vulnerability class was still reproducible as of his July 28 publication. He stated, "The vulnerability class therefore remains exploitable at the time of publication." ## Not a Zero-Click Attack, But Still a Threat This attack is not a zero-click exploit and does not involve the execution of conventional malware. It specifically requires a **Copilot** drafting or editing operation where the malicious document enters the model's context. This can occur either as an attachment or as a **OneDrive** source selected by **Work IQ**, the intelligence engine powering **Microsoft 365 Copilot**. While no in-the-wild exploitation has been reported, and **Måløy** has withheld the complete payload, the implications are significant for data integrity and information security. He advises treating external documents as untrusted, thoroughly reviewing attached documents before initiating any generation or editing process, and verifying **Copilot**-generated or edited files prior to reuse or sharing. ## How Hidden Instructions Deceive Copilot The core of the attack leverages **Copilot's** document processing. **Copilot** reads source files to determine content for a draft and can misinterpret embedded instructions as part of the user's legitimate request. In **Måløy's** proof of concept, **Copilot** halved every financial figure and copied the full malicious prompt into the output, rendered in white, eight-point text, without disclosing either modification. **Måløy** explained that **Word** strips color and font size before transmitting document text to the large language model, making white-on-white instructions legible to the model. One part of the payload altered the document's content, while another instructed **Copilot** to copy and conceal these instructions, framing these commands as requirements for source-tracking and readability.  **Microsoft** states that **Word** can ground a draft on up to 20 files, emails, or meetings, and 'Edit with **Copilot**' can utilize **Work IQ**. During **Måløy's** testing, **Copilot** searched **OneDrive** for a quarterly report, located the malicious market analysis outside the expected folder, and included it, with **Work IQ** deeming the file relevant. Crucially, when only the infected Q1 report was attached (without the original malicious document), **Copilot** proceeded to halve figures in a Q2 draft and re-appended the prompt. This demonstrates that an ordinary, internally generated document can become a carrier. However, the chain does not self-propagate; each 'hop' requires another **Copilot** drafting or editing operation where the carrier document enters the model's context. ## The Provenance Problem The hidden formatting acts as the initial entry point. Once **Copilot** copies the instructions into an internally generated document, the original source is no longer present when that file is used in a subsequent session. **Måløy** argues that this break in the provenance trail significantly complicates the tracing of such manipulations. As of this publication, searches of **NVD**, **CVE.org**, and **Microsoft's Security Update Guide** revealed no public **CVE** or standalone **Microsoft** advisory for this specific **Word** finding. **Microsoft** mentions that jailbreak and cross-prompt injection attack (XPIA) classifiers help block high-risk prompts, though their availability may vary across **Copilot** scenarios. **Defender for Office 365** includes mail-flow inspection for inbound email, and **Microsoft** describes **Copilot's** runtime safeguards as covering injected instructions from grounded content. Neither **Microsoft** nor **Måløy** has confirmed whether this exact payload is detected at either layer. **Måløy** asserts that no customer-side remediation fully addresses the issue, arguing that payload-specific blocks are insufficient for this class of vulnerability. He contends that a model must process attacker-controlled content to assess its maliciousness, meaning "the content being inspected participates in the act of inspection." **Microsoft** echoed a similar sentiment in a June post on AI memory, emphasizing that "Prompting alone is not a reliable security boundary" and that memory access and isolation should be controlled by deterministic systems rather than relying on model instructions.