Hidden instructions in Word make Copilot alter and spread documents

The Norwegian researcher Håkon Måløy published an attack chain against Microsoft Copilot for Word on 28 July 2026. The attack rests on instructions hidden inside an entirely ordinary Word document, which Copilot reads and follows when the document is used as source material. In the demonstration Copilot alters the content of the document it writes, and copies the instructions into that new document at the same time. Måløy reported the weakness to the Microsoft Security Response Center on 6 March 2026, and the case ran as coordinated disclosure for 144 days. Måløy states that the full chain could be reproduced with a modified payload after the mitigations from Microsoft were in place.

What happens technically

The attack is a cross domain prompt injection. The mechanism rests on a well known property of language models. The model receives the developer instruction and the content of the document in the same context window, and has no separate channel that keeps the two apart. Text in an attachment can therefore be read as an order. In this case the order is written in white type on a white background at font size 8, according to Måløy's write up. A human sees nothing in the document. Copilot strips the formatting before the content reaches the model, as itnews describes it, and the hidden text is then left on equal footing with the rest of the text.

The second element is the propagation. Måløy shows that Copilot does not merely follow the instruction in the original document, but also writes it into the document it produces. The new document looks normal to the reader, and carries the payload onwards to the next time somebody uses it as source material in a Copilot session. The instructions then fire again, without the attacker's original document being anywhere near. In the demonstration the attack halved the figures in a financial document, according to itnews. Microsoft deployed several mitigations during the disclosure period, among them an upgrade of the model behind Copilot to GPT-5.5. Måløy states that a fix from April was bypassed the following day, and that the chain still ran with the mitigations in place. There is therefore no customer side fix that closes this class of weakness, and Måløy grounds the publication in the need for defenders to know the class exists.

What this means for you if you use Copilot in Word

In our view the case moves a known problem into the most ordinary workflow you have. Word documents arrive from outside every single day, from customers, suppliers, law firms and public agencies. When the assistant reads them on your behalf, the document is no longer merely something to be read. The same holds when a colleague lets the assistant read them. It is something that can trigger action. The consequence lands first of all on the integrity of the text, meaning the trust that the figures and the wording in a document are the ones the author actually put there.

The other side of the case is your traceability. An altered figure in a proposal or in a board paper raises no alarm in security monitoring, because no boundary was crossed and no malware was run. If you are covered by NIS2, this belongs in the Article 21 requirements for risk management and for security in the acquisition and use of systems. ISO/IEC 42001 offers a framework for governing AI systems, with accountability, control and verifiability. The practical move is to treat documents from outside as untrusted input in your AI workflow, in the same way you treat macros from the internet today.

Berigo recommends

• Treat documents from external senders as untrusted input, and do not let them go straight into a Copilot session without someone reviewing them.
• Require employees to read through what the assistant produced before the document is passed on, especially where figures carry the decision.
• Map which workflows let AI assistants read documents from outside, and consider closing some of them until the class of weakness is closed.
• Consider routines that strip hidden formatting before a document is used as source material, for instance conversion to plain text.
• Add prompt injection as a separate item in the risk assessment for AI tools, with measures and a named owner.