Microsoft 365 Copilot in Word can reportedly be manipulated by hidden instructions embedded in an otherwise ordinary document, potentially altering generated content and carrying those instructions into later Copilot-created files.
The Register reported Wednesday that Norwegian AI researcher Håkon Måløy disclosed the issue after coordinating with Microsoft since March 2026. His proof of concept uses tiny white text in a Word document to inject instructions into Copilot’s working context—an indirect prompt injection problem that does not require an attacker to access the victim organization’s Microsoft 365 tenant.
In Måløy’s example, an employee uses an externally obtained market-analysis document as source material for a financial report. Hidden text tells Copilot to change figures in the output and insert the same malicious instructions into the new document. If another user later feeds that output back into Copilot, the process can repeat.
Microsoft told The Register it has addressed the reported findings and uses layered safeguards intended to block malicious instructions and keep tasks aligned with the user’s request. Måløy, however, said Microsoft mitigated his original payload but that revised wording continued to work, including in tests that changed financial data. He said two mitigation efforts, one involving a model update, had not closed the broader vulnerability class.
The research does not describe conventional malware executing on a PC, nor does it rely on VBA macros, an Office exploit, or code embedded in a file. The risk is that Copilot may treat attacker-controlled document content as instructions rather than merely information to analyze.
That distinction matters for administrators. Existing controls that block macros, inspect attachments, or restrict executable content do not necessarily prevent a user from opening a clean-looking
Microsoft has recently expanded Copilot in Word’s editing role, including direct document edits that remain reviewable and reversible. That makes document review and version history useful compensating controls—but they are not a technical fix for an instruction that changes the substance of a generated report before it is distributed.
Practical steps include:
The Register reported Wednesday that Norwegian AI researcher Håkon Måløy disclosed the issue after coordinating with Microsoft since March 2026. His proof of concept uses tiny white text in a Word document to inject instructions into Copilot’s working context—an indirect prompt injection problem that does not require an attacker to access the victim organization’s Microsoft 365 tenant.
In Måløy’s example, an employee uses an externally obtained market-analysis document as source material for a financial report. Hidden text tells Copilot to change figures in the output and insert the same malicious instructions into the new document. If another user later feeds that output back into Copilot, the process can repeat.
Microsoft told The Register it has addressed the reported findings and uses layered safeguards intended to block malicious instructions and keep tasks aligned with the user’s request. Måløy, however, said Microsoft mitigated his original payload but that revised wording continued to work, including in tests that changed financial data. He said two mitigation efforts, one involving a model update, had not closed the broader vulnerability class.
This Is Not a Word Macro Problem
The research does not describe conventional malware executing on a PC, nor does it rely on VBA macros, an Office exploit, or code embedded in a file. The risk is that Copilot may treat attacker-controlled document content as instructions rather than merely information to analyze.That distinction matters for administrators. Existing controls that block macros, inspect attachments, or restrict executable content do not necessarily prevent a user from opening a clean-looking
.docx file and then asking Copilot to summarize, rewrite, or incorporate it into a new document.Microsoft has recently expanded Copilot in Word’s editing role, including direct document edits that remain reviewable and reversible. That makes document review and version history useful compensating controls—but they are not a technical fix for an instruction that changes the substance of a generated report before it is distributed.
Treat Copilot Context as an Intake Boundary
Until Microsoft provides a durable mitigation, organizations using Copilot in Word should treat third-party documents added to Copilot context as untrusted input, even when they come from familiar websites, partners, or email contacts.Practical steps include:
- Require human review of source documents before they are used as Copilot context for finance, legal, compliance, or executive communications.
- Require a second reviewer for Copilot-generated documents that contain figures, recommendations, contractual terms, or operational instructions.
- Preserve Word version history and use tracked changes so unexpected edits can be investigated.
- Train users that hidden formatting, copied content, and web-derived documents can influence AI output even when no macro warning or security alert appears.
- Consider limiting Copilot use with externally sourced material in high-assurance workflows until the organization has tested its own safeguards.